Description

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Application Server). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks of this vulnerability can result in takeover of Oracle Agile PLM. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-18T21:18:03.650Z",
  "pubdate": "2026-08-18T21:18:03.650Z",
  "executiveSummary": "An easily exploitable vulnerability exists within the Application Server component of Oracle Agile PLM version 9.3.6, posing severe risks to organizational infrastructure. This security flaw allows a low-privileged attacker with network access via the HTTP protocol to successfully compromise the target system, potentially leading to a complete takeover of Oracle Agile PLM. The vulnerability carries a CVSS 3.1 Base Score of 8.8, with high impacts across confidentiality, integrity, and availability.\nThe exploitation of this vulnerability requires network connectivity and low-level user privileges, but no user interaction is necessary to achieve successful execution. The high severity stems from the ability of an authenticated, low-privileged adversary to escalate their access and completely compromise the administrative and operational integrity of the application server. Given that Oracle Agile PLM manages critical product lifecycle data, a successful attack compromises sensitive intellectual property, disrupts business operations, and undermines the overall security posture of the enterprise environment.",
  "technicalDetails": "The vulnerability resides in the Application Server component of Oracle Agile PLM version 9.3.6, specifically affecting how incoming HTTP requests are processed and authorized. The root cause stems from insufficient validation and authorization checks within the application server's handling of network communications, which allows low-privileged actors to bypass security controls and execute unauthorized administrative actions.\nThe attack flow begins when an adversary, authenticated with low privileges, leverages network access via the HTTP protocol to transmit crafted requests directly to the vulnerable Application Server component. Due to inadequate privilege verification routines within the affected code paths, the server improperly trusts the incoming input, permitting the execution of privileged functions that should be restricted to administrative roles.\nBecause the attack vector is network-based (AV:N) and complexity is low (AC:L), an attacker requires no prior physical access or complex race conditions to exploit the flaw. Furthermore, the exploitation does not rely on social engineering or user interaction (UI:N). Once the malicious payload is processed by the application server, the attacker can manipulate core application logic, resulting in complete system compromise.\nThe post-exploitation impact is catastrophic, achieving a full takeover of Oracle Agile PLM (Scope Unchanged, C:H/I:H/A:H). Attackers attain the capability to read, modify, or exfiltrate highly confidential product lifecycle data, alter design specifications, tamper with system integrity, and cause denial-of-service conditions by crashing or disabling the application server."
}