Oracle Agile PLM CVE-2026-71040

No special conditions - remote unauthenticated exploitation over HTTP against the affected Security component of Oracle Agile PLM 9.3.6, per CVSS AV:N/AC:L/PR:N/UI:N. The attacker needs only network-layer access to the application's HTTP(S) listener and requires no credentials, no user interaction, and no non-default configuration according to the available data. The primary limiting factor is network reachability: instances confined to internal or VPN-only segments are exposable only to insiders or an attacker who has already gained a foothold, whereas any Agile PLM 9.3.6 endpoint reachable from the internet or a broad partner network is directly at risk. Exploitation is scoped to version 9.3.6 as the named supported affected release.

The signals align strongly toward high real-world risk rather than an inflated score: the CVSS vector (AV:N/AC:L/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated exploitation, and the impact metrics (C:H/I:H/A:H, S:U) map to full application takeover, which Oracle's own description confirms. No EPSS score, KEV listing, or SSVC decision was provided in the input, so probabilistic and active-exploitation signals cannot be weighed - the assessment rests on CVSS and Oracle's takeover language alone, and the absence of EPSS/KEV data should be treated as unknown rather than as evidence of low risk. Given that this is a legacy but business-critical supply-chain system, even a mid-sized manufacturing operator in gliwice running an internet- or partner-network-exposed Agile PLM instance should treat this as urgent and patch in the current cycle. The main mitigating factor is deployment context: many Agile PLM instances sit on internal networks, which reduces external exposure but does not eliminate insider or lateral-movement risk.

An attacker with only network reach to the Agile PLM HTTP interface - for example a malicious insider, a compromised supplier account on a shared network, or an external actor if the interface is internet-exposed - sends crafted HTTP requests to the Security component and, without any credentials or user interaction, gains full control of the application. From there the attacker can read or alter product designs, bills of materials, and supplier data and disrupt the service. No public exploit is identified at time of analysis, but the low attack complexity means a working exploit could be developed quickly once technical details emerge.