Oracle Agile PLM CVE-2026-46859

The target must be Oracle Agile PLM version 9.3.6 with its HTTP(S) web tier reachable from the attacker's network position; no authentication, no user interaction, and no special non-default configuration are required per the CVSS vector AV:N/AC:L/PR:N/UI:N. The principal limiting factor is network exposure: Agile PLM is typically deployed inside corporate networks behind VPNs, so internet-facing instances or attackers already on internal/segmented manufacturing networks are the realistic exploitation population. Versions other than 9.3.6 are not listed as affected, and Oracle did not identify a feature toggle that disables the vulnerable code path.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) is maximal for a non-scope-changing flaw, indicating low-complexity, unauthenticated network exploitation leading to full product takeover. There is no CISA KEV listing and no EPSS score supplied, and no public exploit identified at time of analysis, so real-world exploitation pressure is currently unverified despite the catastrophic CVSS. Oracle Agile PLM 9.3.6 is a long-lived, end-of-extended-support-era release frequently deployed inside manufacturing and supply-chain enterprises, so although mass-scanning risk may be modest, targeted exploitation against exposed deployments is highly plausible once details are reverse-engineered from the Oracle patch - making this a real priority for any organization still running 9.3.6, not a high-CVSS-but-low-real-risk issue. Key gaps: no CWE, no specific vulnerable component or endpoint named by Oracle, and the 'Information Disclosure' tag appears to understate the full C:H/I:H/A:H impact stated in the description.

An attacker who can reach the Agile PLM web interface - for example via an internet-exposed supplier portal or from a foothold on the corporate network - sends a single crafted HTTP request to the vulnerable Security component and obtains administrative control of the PLM instance without credentials. From there they exfiltrate confidential product designs, BOMs, and supplier data, tamper with engineering change orders, or pivot to the underlying application server. No public exploit identified at time of analysis, but the CVSS AC:L/PR:N profile implies a straightforward, scriptable exploit once details emerge.