Oracle Agile PLM CVE-2026-83260

Exploitation requires (1) network reachability to the Oracle Agile PLM application server over the T3 or IIOP protocols (the WebLogic/Java RMI channels), and (2) high privileges on the target - per CVSS PR:H the attacker must already hold an elevated/authenticated privileged role, not an anonymous or low-privilege account. Only Agile PLM version 9.3.6 is listed as affected, and the vulnerable code is the Event Java PX component. The key limiting factor is the PR:H requirement, which restricts realistic exploitation to insiders or attackers who have already compromised a privileged account; no user interaction is required (UI:N) and attack complexity is low (AC:L). T3/IIOP exposure can be reduced by network segmentation and connection filtering, further limiting reachable attackers.

This is a genuinely severe vulnerability but with an important real-world limiter. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H = 9.1) describes a network-reachable, low-complexity flaw yielding full compromise (complete confidentiality, integrity, and availability loss) of Oracle Agile PLM, with a scope change indicating impact beyond the vulnerable component. The critical qualifier is PR:H - exploitation requires the attacker to already hold high privileges on the target, which substantially narrows the realistic threat population compared with the pre-auth (PR:N) siblings in the same Oracle CPU. No EPSS score, no CISA KEV listing, and no public POC are present in the supplied data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Oracle's advisory (cspusep2026) provides zero technical detail, which is standard for Oracle CPUs. Net assessment: a legitimately high-severity, well-calibrated 9.1, but the PR:H prerequisite makes it a priority for internal/lateral-movement and insider-abuse scenarios rather than a mass-exploitation, internet-facing emergency. Note one metadata conflict: the 'Information Disclosure' tag understates the full C:H/I:H/A:H takeover described.

A high-privileged attacker (compromised admin/service account or a malicious insider) with network reachability to the Agile PLM application server sends crafted requests over the T3 or IIOP protocol to the Event Java PX component. Successful exploitation results in complete takeover of Agile PLM and, due to the scope change, significant impact on additional connected products. No public exploit code is identified at time of analysis, and low attack complexity (AC:L) means no special timing or race conditions are needed once the privilege prerequisite is met.