Oracle Agile PLM CVE-2026-71045

The attacker requires network-level HTTP access to the Oracle Agile PLM 9.3.6 instance - no authentication is needed (PR:N per CVSS). The primary limiting factor is UI:R: a legitimate user with access to the PLM application must interact with attacker-controlled content (e.g., click a crafted link, load a malicious page). This limits opportunistic mass exploitation but does not prevent targeted attacks via phishing. Exploitation is strictly bounded to Oracle Agile PLM version 9.3.6; no other versions are confirmed affected. The Security component must be reachable via HTTP. No special configuration state, race condition, or non-default setting is indicated as required (AC:L). Exploitation from external networks is possible if the PLM interface is internet-facing; organizations with PLM restricted to internal networks face reduced but non-zero risk from insider threat or compromised internal hosts.

The CVSS 3.1 score of 8.8 is substantiated by network accessibility, low complexity, no required attacker privileges, and full CIA impact - tempered only by the UI:R prerequisite. In enterprise supply chain environments, UI:R is a modest constraint, as targeted phishing or watering-hole delivery can reliably induce victim interaction. No EPSS score was provided in the input data, and the vulnerability is not listed in CISA KEV, so active exploitation is not confirmed. Notably, the intelligence tags label this 'Information Disclosure,' which directly conflicts with Oracle's own CVSS declaration of system takeover (C:H/I:H/A:H) - defenders should treat the Oracle advisory language as authoritative and not underweight severity based on the tag. The absence of a specified CWE prevents confident root cause classification and limits pre-patch defensive tuning. Overall, this is a genuine high-priority patch target for any organization running Agile PLM 9.3.6 with HTTP network exposure.

An unauthenticated attacker identifies an internet- or intranet-accessible Oracle Agile PLM 9.3.6 instance and crafts a malicious HTTP link or embedded payload targeting the Security component. The attacker delivers this via phishing email or social engineering to a PLM user, who interacts with the content in their browser session. Upon interaction, the exploit executes within the victim's session context, granting the attacker full control over the PLM instance - enabling exfiltration of sensitive product lifecycle data, modification of engineering records, or disruption of PLM services. No public POC has been identified, but AC:L indicates exploit development requires no specialized conditions.