Oracle Agile PLM CVE-2026-47009

The attacker must deliver a crafted HTTP request to the Oracle Agile PLM 9.3.6 instance via network access, and a legitimate user (the victim) must interact with that request - for example, by clicking a crafted link or being redirected through a malicious page. The vulnerability is in the Folders, Files & Attachments component specifically, so the bypass is scoped to that functional area of the PLM application. Exploitation is limited by the UI:R requirement, meaning fully automated, unattended exploitation against the server alone is not supported by the CVSS vector - human interaction from a second party is mandatory. No special server configuration or non-default deployment mode is required beyond the standard Oracle Agile PLM 9.3.6 installation. Exploitation does not require the attacker to hold any prior credentials or privileges in the PLM system.

The CVSS 3.1 score of 6.5 (Medium) partially understates the operational sensitivity: while the score correctly reflects UI:R as a meaningful barrier, the affected product stores critical intellectual property and supply chain data, raising the business impact beyond what the numerical score conveys. AV:N/AC:L/PR:N confirms the attacker needs no authentication and no special network position - only a path to deliver a crafted HTTP request to a victim. The UI:R constraint limits mass automated exploitation but does not prevent targeted attacks against specific high-value users. EPSS data was not provided in the intelligence feed, leaving exploitation probability unquantified. KEV status is absent, and no POC has been identified, so exploitation remains theoretical at time of analysis. The 'Authentication Bypass' tag suggests the root cause may be more severe than the Confidentiality-only impact implies - defenders should evaluate whether the bypass could be chained with other vulnerabilities. The primary limiting factor is that an attacker must induce victim interaction, typically requiring a social engineering step.

An attacker targeting a manufacturing organization's sensitive design documents identifies a victim user with access to Oracle Agile PLM 9.3.6. The attacker crafts a malicious HTTP URL targeting the Folders, Files & Attachments component and delivers it via phishing email or a compromised intranet page. When the victim clicks the link, the authentication bypass is triggered and the attacker gains unauthorized read access to all PLM data accessible by the victim, including proprietary product designs and supply chain documents. No public POC has been identified, but the low attack complexity suggests replication would be straightforward once the specific bypass mechanism is understood.