Description

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Security). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Agile PLM executes to compromise Oracle Agile PLM. While the vulnerability is in Oracle Agile PLM, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Agile PLM. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-18T21:18:04.483Z",
  "pubdate": "2026-08-18T21:18:04.483Z",
  "executiveSummary": "A security vulnerability has been identified within the Security component of the Oracle Agile PLM product, specifically affecting version 9.3.6. This vulnerability represents a severe risk to organizational infrastructure, presenting a CVSS 3.1 Base Score of 8.8 with a vector of CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. The flaw is classified as easily exploitable under specific preconditions, requiring a low-privileged attacker to already possess interactive or programmatic logon access to the underlying infrastructure where the Oracle Agile PLM application executes.\nDespite requiring local access to the host environment, the vulnerability exhibits a scope change (S:C), indicating that successful exploitation is not strictly limited to the Oracle Agile PLM application boundary. Instead, an attack can propagate and significantly impact additional integrated or co-located products and systems within the broader enterprise infrastructure. The ultimate consequence of successful exploitation is the complete takeover of Oracle Agile PLM, granting the adversary full control over the application's confidentiality, integrity, and availability.\nGiven the high severity and potential for lateral compromise across system components, organizations running the affected Oracle Agile PLM version must prioritize risk management through strict access controls, rigorous monitoring of local infrastructure logon sessions, and the application of official vendor patches or security advisories as soon as they become available.",
  "technicalDetails": "The vulnerability resides within the Security component of Oracle Agile PLM version 9.3.6, concerning how the application manages internal security controls, permissions, or interactions with the underlying operating system and infrastructural dependencies. The root cause stems from inadequate validation, improper privilege boundary enforcement, or insecure handling of local resources and execution contexts within the application's architecture.\nExploitation of this vulnerability requires the attacker to satisfy specific preconditions: the adversary must have prior local access to the infrastructure hosting the Oracle Agile PLM application. This implies that the threat actor possesses low privileges (PR:L) and a valid logon mechanism (AV:L) to the host system. The attack complexity is rated as low (AC:L), and user interaction is not required (UI:N), meaning the attacker can independently execute the attack sequence without social engineering or administrative assistance.\nThe step-by-step attack flow begins with the low-privileged user leveraging their existing local access to the execution environment. By interacting with vulnerable internal interfaces, misconfigured service parameters, or unsecured files and processes associated with the Security component of Oracle Agile PLM, the attacker exploits the underlying logic flaw. Because the application executes within a privileged context or interacts closely with shared infrastructure components, the local manipulation allows the adversary to bypass intended authorization checks.\nAs the exploit progresses, the scope change (S:C) metric indicates that the compromise transcends the immediate boundaries of Oracle Agile PLM. The attacker can leverage the initial application-level or component-level compromise to interact with broader operating system resources, interconnected services, or co-located products on the same infrastructure. This lateral movement and escalation of privileges ultimately leads to a full system or application takeover.\nThe post-exploitation impact is catastrophic for the affected environment, resulting in complete compromise of confidentiality (C:H), integrity (I:H), and availability (A:H). An attacker who achieves takeover of Oracle Agile PLM can read sensitive proprietary design data, manipulate product lifecycle records, corrupt system databases, deploy persistent backdoors, or disrupt critical supply chain and manufacturing operations managed by the platform."
}