EUVD-2026-106117
GHSA-p839-662x-cx3q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Agile PLM Web Client over HTTP
-
ExploitSend crafted unauthenticated request
-
ExecutionAccess subset of PLM data
-
ImpactExfiltrate disclosed information
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions beyond reachability - remote unauthenticated exploitation over HTTP against Oracle Agile PLM 9.3.6 Web Client (PR:N/UI:N/AC:L), so an exposed Web Client endpoint is sufficient. Limiting factors: impact is confined to unauthorized read access to a subset of Agile PLM data (C:L, I:N, A:N), the flaw is specific to version 9.3.6, and real exposure depends on whether the Web Client is network-reachable to the attacker (commonly internal-network or VPN-gated in enterprise deployments rather than internet-facing). |
| Impact | This is a moderate-severity information disclosure flaw (CVSS 3.1 base 5.3). The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N confirms network-reachable, low-complexity, unauthenticated exploitation over HTTP with no user interaction, which argues for easy reach. However, impact is deliberately narrow: only low confidentiality (read access to a subset of data), with no integrity or availability impact and no scope change. No EPSS score was provided, the CVE is NOT on the CISA KEV list, and no public POC was identified, so there is no signal of active or widespread exploitation. The headline accessibility (unauthenticated/network) is tempered by the read-only, partial-data impact, making this a real-but-lower-priority issue rather than a crown-jewel compromise. Note a potential signal conflict: the input Tags include 'Authentication Bypass', but the description characterizes the flaw as unauthenticated read access to a data subset (information disclosure), not a privilege/authentication bypass - verify the nature with the Oracle advisory before treating it as an auth-bypass. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends crafted HTTP requests to a network-reachable Oracle Agile PLM 9.3.6 Web Client and retrieves a subset of PLM data they should not be able to read. Because no authentication, user interaction, or special timing is required (AC:L), the request can be issued directly against a reachable endpoint. No public exploit code was identified at the time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Unauthenticated remote attackers with HTTP access to the Oracle Agile PLM Web Client can read a limited subset of application data in version 9.3.6, a confidentiality-only exposure rated CVSS 3.1 base score 5.3 (AV:N/AC:L/PR:N/UI:N/C:L). The flaw is specific to Agile PLM 9.3.6 and does not affect integrity or availability, so the impact is bounded to information disclosure rather than data tampering or service outage. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and real-world risk is driven mainly by whether the Web Client is internet-facing or reachable from untrusted network segments.
RemediationAI
Oracle publishes Agile PLM fixes through its Critical Patch Update cycle; apply the October 2026 CPU update referenced at https://www.oracle.com/security-alerts/cpuoct2026.html, which is the vendor advisory associated with this CVE, and confirm the exact patched build with Oracle Support because the provided data does not specify a fix version number. Because exploitation requires only HTTP reachability to the Web Client (PR:N/UI:N), the most effective interim control is to restrict that interface to trusted networks: place the Web Client behind a VPN or reverse-proxy allowlist, or firewall it from the internet and untrusted segments, accepting that this reduces access for legitimate remote users. In addition, review web access logs for unauthenticated requests to Agile PLM endpoints and alert on anomalous read patterns, and avoid exposing the Web Client directly to the internet until the CPU patch is verified as applied; no endpoint-specific disablement guidance is available in the provided data, so network segmentation is the practical compensating control.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Agile PLM is an enterprise product lifecycle management platform used for bill-of-materials, change, and quality management; the vulnerable component is its Web Client, the browser-facing interface that communicates with the application over HTTP. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N describes a network-reachable, low-complexity attack requiring no privileges and no user interaction, with scope unchanged and only low confidentiality impact, which is consistent with an access-control or information-exposure weakness in how the Web Client serves data to unauthenticated requests. No CWE was supplied in the source data, so the precise root-cause class (for example, a missing authorization check versus improper data filtering) is not confirmed; the Oracle advisory attributes the issue to the Web Client component of Oracle Supply Chain and limits affected deployments to Agile PLM 9.3.6.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Description confirms unauthenticated network HTTP access (AV:N/AC:L/PR:N/UI:N) yielding partial data read only, so C:L with I:N/A:N and no scope change.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Web Client). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Agile PLM accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB