What is the CVSS score of CVE-2026-71039?

CVE-2026-71039 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Agile PLM are affected by CVE-2026-71039?

Oracle Agile PLM 9.3.6 is vulnerable to complete system takeover by low-privileged network users, with no patch currently available and full compromise of data confidentiality, integrity, and…

How to fix or mitigate CVE-2026-71039?

Within 24 hours, conduct inventory of all systems running Oracle Agile PLM 9.3.6 and map network exposure points and criticality rankings. Within 7 days, segment network access to affected systems using firewall rules that restrict HTTP/HTTPS traffic to essential business locations only, disable unnecessary remote access, and implement enhanced logging on all access attempts. Within 30 days, develop and execute an upgrade plan to a patched Oracle Agile PLM version, engage vendor for interim mitigation guidance if upgrades require extended timelines, and deploy Web Application Firewall rules to detect exploitation patterns while planning the migration.

Oracle Agile PLM CVE-2026-71039

EUVD-2026-61986 HIGH

Improper Access Control (CWE-284)

2026-08-18 secalert_us@oracle.com

GHSA-vqxc-q32g-cq8p

Authentication Bypass Oracle Agile Product Lifecycle Management

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network HTTP access with low-privilege credential required; full CIA takeover impact and no scope change align with Oracle's characterization; PR:L reflects mandatory authentication.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 18, 2026 - 23:12 vuln.today

CVE Published

Aug 18, 2026 - 21:18 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Application Server). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks of this vulnerability can result in takeover of Oracle Agile PLM. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Oracle Agile PLM 9.3.6 Application Server is susceptible to complete system takeover by a low-privileged attacker operating over HTTP, with no user interaction required. The CVSS 3.1 score of 8.8 reflects full confidentiality, integrity, and availability impact, consistent with Oracle's description of total compromise. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires a valid low-privileged account on the Oracle Agile PLM instance and HTTP network connectivity to the Application Server. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 score of 8.8 is well-supported by the vector metrics: network-accessible (AV:N), low attack complexity (AC:L), low privilege required (PR:L), no user interaction (UI:N), and full CIA high impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Apply Oracle's Critical Patch Update for August 2026, available via the Oracle security advisory at https://www.oracle.com/security-alerts/cspuaug2026.html. … Detailed patch versions, workarounds, and compensating controls in full report.