Oracle Agile PLM CVE-2026-71039

Exploitation requires a valid low-privileged account on the Oracle Agile PLM instance and HTTP network connectivity to the Application Server. The CVSS PR:L metric confirms that some level of authentication is necessary - unauthenticated exploitation is not supported by the vendor-provided vector. No user interaction by a victim is required (UI:N), and no special non-default configuration is stated as a prerequisite in the description. Limiting factors include the credential requirement, which restricts exploitation to authenticated users or adversaries who have obtained valid credentials through phishing, credential stuffing, or insider access. Network segmentation that places the Agile PLM Application Server behind a VPN or firewall would further limit the attack surface to credentialed internal or VPN-connected users.

The CVSS 3.1 score of 8.8 is well-supported by the vector metrics: network-accessible (AV:N), low attack complexity (AC:L), low privilege required (PR:L), no user interaction (UI:N), and full CIA high impact. This is not a high-CVSS-but-low-real-risk scenario - the combination of network reachability, low complexity, and catastrophic impact (system takeover) represents a genuine high-priority threat for any organization running Oracle Agile PLM 9.3.6. No EPSS score was provided in the available data, and the vulnerability is not currently listed in the CISA KEV catalog, meaning active exploitation has not been publicly confirmed. However, the PR:L requirement (valid credentials needed) provides some natural friction - unauthenticated exploitation is not supported by the vector. The 'Information Disclosure' tag in source intelligence conflicts with the full-takeover characterization from Oracle's own advisory; the CVSS vector is the authoritative signal here and should be trusted over the tag. EPSS data absence is a gap; practitioners should monitor for updates.

An attacker with a low-privileged Oracle Agile PLM account - such as a disgruntled employee, contractor, or an adversary who has phished or purchased credentials - sends a specially crafted HTTP request to the Agile PLM Application Server component. The request triggers the underlying vulnerability with no additional user interaction required, yielding full control over the PLM system including access to sensitive product design data, engineering documents, and supply chain records, as well as the ability to modify or destroy data. No public proof-of-concept code has been identified at time of analysis.