Oracle Agile PLM CVE-2026-71046

Exploitation requires a local logon to the operating system or application environment hosting Oracle Agile PLM 9.3.6 - the attacker must have an account (OS-level or application-tier) with at minimum low privileges (CVSS PR:L, AV:L confirmed). The attack targets the Security component specifically within Oracle Agile PLM. No user interaction is required, and attack complexity is low, meaning no race conditions, special timing, or environmental setup is needed beyond the logon itself. The primary limiting factor is the local attack vector: remote unauthenticated attackers cannot directly reach this vulnerability without first obtaining host access through a separate vector. No non-default configuration setting is described as required - any standard deployment of Oracle Agile PLM 9.3.6 where a low-privileged user can log into the host appears to be in scope. No platform-specific restriction (OS type, architecture) is noted in the available data.

The CVSS 3.1 score of 8.8 (High) is driven by the complete C:H/I:H/A:H impact triad and the scope change rather than a network attack vector - the local vector (AV:L) meaningfully constrains the attacker pool to those with existing host-level access. However, in enterprise deployments of Oracle Agile PLM, shared service accounts, jump hosts, or compromised application-tier credentials are realistic initial access paths, meaning the local constraint should not be treated as a significant barrier in practice. The low privilege requirement (PR:L) is especially concerning: any authenticated user on the host - including application service accounts - can trigger exploitation with no further escalation steps needed. No EPSS data was available for quantitative exploitation probability assessment, and the vulnerability is not listed in CISA KEV, suggesting no confirmed widespread active exploitation at time of analysis. Even a mid-sized municipal IT team in sanok that relies on Oracle Supply Chain infrastructure should treat this as urgent given the low complexity and full-takeover outcome. The scope change adds a multiplier effect: compromise of Agile PLM could propagate to co-located Oracle SCM components, raising the effective blast radius well beyond a single application.

An attacker who has obtained a low-privileged account on the server running Oracle Agile PLM 9.3.6 - via credential theft, insider access, or compromise of an adjacent system with shared credentials - exploits the Security component flaw without needing additional privileges or triggering any user interaction. The attacker achieves full control of the Agile PLM instance and, due to the scope change, may pivot laterally to other Oracle Supply Chain components sharing the same host or trust boundary. No public exploit code has been identified at time of analysis.