Oracle Agile PLM CVE-2026-71041

Exploitation requires an existing low-privileged local operating system logon session on the infrastructure host where Oracle Agile PLM 9.3.6 is installed and executing - network-only access is insufficient per the AV:L vector. High attack complexity (AC:H) means the attacker must meet additional unspecified conditions beyond mere local presence, likely involving specific timing, environmental state, or interaction with the Gantt Chart component under particular configurations. Exploitation is limited by: (1) mandatory local OS account on the PLM host, not just PLM application credentials; (2) high attack complexity requiring non-trivial conditions to be satisfied; (3) the flaw is isolated to the Gantt Chart component of version 9.3.6 specifically, limiting exposure to that exact version. No remote exploitation path is indicated by the local attack vector.

The CVSS 3.1 base score of 7.0 reflects a genuinely constrained but high-impact vulnerability. The local attack vector (AV:L) is the primary risk limiter - an attacker must already possess a logon session on the physical or virtual host running Oracle Agile PLM, not merely network connectivity. The high attack complexity (AC:H) introduces further barriers, indicating that exploitation likely depends on specific timing, environmental state, or configuration conditions beyond simple authenticated access. Despite these constraints, the full C:H/I:H/A:H impact confirms that a successful attack yields complete application takeover, making this a priority for organizations running PLM on shared or multi-tenant infrastructure where low-privileged OS accounts are broadly distributed. No EPSS score was provided in the available intelligence, preventing probabilistic exploitation likelihood assessment. The metadata tag 'Information Disclosure' conflicts with the stated full C/I/A:H impact in the vendor description - this discrepancy is unresolved from available data and should be verified against the Oracle CPU advisory directly. No public POC code and no CISA KEV listing exist, suggesting exploitation remains non-trivial and targeted rather than opportunistic.

A low-privileged employee or contractor with an existing OS-level account on the server hosting Oracle Agile PLM 9.3.6 interacts with the Gantt Chart component and exploits a high-complexity local flaw - likely a race condition or insecure object handling - under specific environmental conditions. Upon successful exploitation, the attacker gains full control of the Oracle Agile PLM application, enabling exfiltration of proprietary product lifecycle data, manipulation of BOMs and project records, or denial of service to the PLM platform. No public exploit code has been identified, making this attack more plausible as a targeted insider or post-compromise action than opportunistic exploitation.