Description

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Security). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Agile PLM. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-18T21:18:04.373Z",
  "pubdate": "2026-08-18T21:18:04.373Z",
  "executiveSummary": "A critical security vulnerability has been identified within the Security component of the Oracle Agile PLM product, specifically affecting version 9.3.6. This vulnerability enables an unauthenticated remote attacker with network access to completely compromise the targeted application. The flaw presents a high risk to organizations utilizing the affected software, as successful exploitation can lead to a total system takeover, granting the adversary complete control over the confidentiality, integrity, and availability of the system.\nThe vulnerability is characterized by its network-exploitable nature and low attack complexity, requiring no prior authentication or specialized privileges within the application. However, successful exploitation is contingent upon specific execution prerequisites, notably requiring human interaction from a victim other than the attacker, such as tricking a user into interacting with a malicious HTTP payload or crafted link. The severity of this flaw is reflected in its CVSS 3.1 Base Score of 8.8, with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, underscoring the severe potential impact on enterprise environments relying on Oracle Agile PLM 9.3.6.",
  "technicalDetails": "The vulnerability resides within the Security component of Oracle Agile PLM version 9.3.6, exposing the application to remote exploitation over the HTTP protocol. The root cause stems from improper handling of untrusted input or state management within the affected component, allowing an unauthenticated attacker to leverage crafted network requests to execute unauthorized actions. Because the vulnerability is exposed via network interfaces (AV:N), any system with direct or indirect HTTP connectivity to the Oracle Agile PLM instance can initiate an attack vector without requiring pre-existing user credentials (PR:N).\nThe attack flow proceeds via the network layer where an unauthenticated adversary crafts and transmits malicious HTTP requests targeting the vulnerable Security component of Oracle Agile PLM 9.3.6. Due to the low attack complexity (AC:L), the exploitation mechanism does not require sophisticated reconnaissance or complex race conditions. However, the vector explicitly dictates a requirement for user interaction (UI:R). This indicates that the exploitation sequence likely relies on techniques such as Cross-Site Scripting (XSS), Cross-Site Request Forgery (CSRF), or a similar client-side injection paradigm where a legitimate authenticated user must be induced into interacting with malicious content supplied by the attacker, such as clicking a crafted hyperlink or visiting a malicious webpage designed to interact with the target PLM application.\nUpon successful execution of the attack chain, the payload manipulates the application logic or session state, enabling the attacker to bypass security controls. The post-exploitation impact spans the complete CIA triad (C:H, I:H, A:H), resulting in a full takeover of Oracle Agile PLM. An adversary achieving system takeover can exfiltrate sensitive proprietary product lifecycle management data, tamper with engineering designs and product configurations, or disrupt core availability, severely compromising the operational integrity of the host organization."
}