What is the CVSS score of CVE-2026-71046?

CVE-2026-71046 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Oracle Agile PLM are affected by CVE-2026-71046?

Oracle Agile PLM 9.3.6 contains a local privilege escalation vulnerability that allows any user with host access to achieve complete system compromise of confidentiality, integrity, and availability.

How to fix or mitigate CVE-2026-71046?

Within 24 hours, identify and inventory all systems running Oracle Agile PLM 9.3.6 and document any co-deployed Oracle Supply Chain products sharing infrastructure. Within 7 days, implement OS-level access controls: disable unnecessary service accounts on Agile PLM hosts, enforce SSH key-based authentication with MFA for all administrative access, restrict sudo privileges, and segment Agile PLM infrastructure from other critical Oracle systems to contain blast radius. Over 30 days, engage Oracle Support to monitor the Critical Patch Update channel for patch release, prepare an emergency upgrade plan to Agile PLM 9.3.7 or later, and implement enhanced logging for privilege escalation attempts and anomalous service account activity.

Oracle Agile PLM CVE-2026-71046

EUVD-2026-61993 HIGH

Improper Access Control (CWE-284)

2026-08-18 secalert_us@oracle.com

GHSA-qh54-p88q-7m8f

Authentication Bypass Oracle Agile Product Lifecycle Management

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Local access with low-privilege account is sufficient for full takeover and scope change to adjacent products; independently corroborates the Oracle-provided vector without modification.

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 18, 2026 - 23:08 vuln.today

CVE Published

Aug 18, 2026 - 21:18 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Security). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Agile PLM executes to compromise Oracle Agile PLM. While the vulnerability is in Oracle Agile PLM, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Agile PLM. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Local privilege escalation in Oracle Agile PLM 9.3.6 enables any low-privileged user with a logon to the host infrastructure to achieve complete system takeover, including full confidentiality, integrity, and availability compromise. The CVSS scope-change indicator (S:C) confirms that successful exploitation can cascade to additional Oracle Supply Chain products co-deployed on the same infrastructure, significantly amplifying blast radius beyond the primary target. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires a local logon to the operating system or application environment hosting Oracle Agile PLM 9.3.6 - the attacker must have an account (OS-level or application-tier) with at minimum low privileges (CVSS PR:L, AV:L confirmed). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 score of 8.8 (High) is driven by the complete C:H/I:H/A:H impact triad and the scope change rather than a network attack vector - the local vector (AV:L) meaningfully constrains the attacker pool to those with existing host-level access. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Apply the Oracle Critical Patch Update for August 2026, which addresses CVE-2026-71046 in Oracle Agile PLM 9.3.6; the advisory is available at https://www.oracle.com/security-alerts/cspuaug2026.html. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, identify and inventory all systems running Oracle Agile PLM 9.3.6 and document any co-deployed Oracle Supply Chain products sharing infrastructure. …

Threat intelligence, references, and detailed analysis are available after sign-in.