Description

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Security). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Agile PLM accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-18T21:18:04.110Z",
  "pubdate": "2026-08-18T21:18:04.110Z",
  "executiveSummary": "An easily exploitable security vulnerability affects the Oracle Agile PLM product within the Oracle Supply Chain component, specifically targeting version 9.3.6. This vulnerability allows an unauthenticated remote attacker with network access via HTTP to compromise the affected system, leading to severe confidentiality breaches.\nSuccessful exploitation of this flaw grants unauthorized access to critical data or complete access to all data accessible within Oracle Agile PLM. The vulnerability carries a CVSS 3.1 Base Score of 7.5, reflecting a high impact exclusively on data confidentiality without affecting system integrity or availability.\nThe attack vector is network-based (AV:N), requiring low attack complexity (AC:L). Crucially, the vulnerability requires no privileges (PR:N) and no user interaction (UI:N), allowing anonymous external threat actors to target exposed instances directly over the HTTP protocol.\nThe risk implications are significant for organizations utilizing Oracle Agile PLM 9.3.6, as exposure to untrusted networks can result in the mass exfiltration of proprietary product lifecycle management data, intellectual property, and sensitive supply chain information.",
  "technicalDetails": "The vulnerability resides within the Security component of Oracle Agile PLM version 9.3.6, exposing endpoints or logic handling authentication, authorization, or access control mechanisms over the HTTP protocol.\nThe root cause stems from improper restriction of excessive authentication attempts, missing authorization checks, or flawed session/token validation logic that permits unauthenticated HTTP requests to bypass security boundaries.\nExploitation occurs remotely over the network via standard HTTP requests without requiring any pre-existing authentication credentials or user interaction. An attacker can craft malicious HTTP requests directed at vulnerable application endpoints to query, traverse, or retrieve sensitive data structures.\nThe attack flow proceeds as follows: First, the attacker identifies a network-accessible instance of Oracle Agile PLM 9.3.6 over HTTP. Second, the attacker formulates an unauthenticated request targeting sensitive data retrieval interfaces within the Security component. Third, due to the absence of robust access controls or validation checks, the application processes the request and returns the requested proprietary data.\nThe post-exploitation impact is characterized by a complete compromise of data confidentiality (C:H). Attackers can systematically harvest critical enterprise data, engineering specifications, and sensitive records accessible to the Oracle Agile PLM environment, while integrity (I:N) and availability (A:N) remain unaffected."
}