Oracle Agile PLM CVE-2026-87252

The precondition is network adjacency: the attacker must have access to the physical communication segment attached to the hardware where Oracle Agile PLM executes, which in practice means the same VLAN, switch segment, or directly attached network as the Agile PLM Application Server - internet-facing exposure alone is not sufficient. No credentials are required (PR:N) and no victim user must interact (UI:N), so the bypass itself is unauthenticated; the limiting factors are the AC:H complexity condition, which implies a specific handshake, transport binding, or state must be reached before the bypass succeeds, and the requirement for the Application Server component to be reachable from that segment, so deployments where the PLM tier is firewalled away from general user networks are materially less exposed. Availability is unaffected (A:N), so an attacker gains data read/write rather than denial of service.

The CVSS 3.1 vector (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, 6.8) is internally consistent with Oracle's wording: the attacker needs no credentials and no user interaction, but must already sit on the Layer 2 segment attached to the Agile PLM host and must satisfy a difficult-to-control condition, which caps the practical exposure well below a typical internet-facing pre-auth flaw. No EPSS score, no KEV entry, and no POC reference were provided, so exploitation status is 'no public exploit identified at time of analysis'; that absence should not be read as proof of safety given Oracle's quarterly patch cycle and the lag between patching and weaponization. Because the impact is full read/write over all PLM-accessible data with no availability effect, the operational consequence is data tampering and intellectual-property exposure rather than outage - a priority for regulated manufacturers, and even a mid-sized municipal IT team in walbrzych should treat this as urgent if an Agile PLM instance shares a flat internal segment with general office endpoints. Key gaps: no CWE, no EPSS value, and no confirmation in the supplied data that a specific patched build exists.

An attacker who already has a foothold on the same physical network segment as the Agile PLM Application Server - for example a compromised office workstation on a flat internal VLAN - sends crafted requests to the PLM service that skip authentication and obtain a privileged session. With that access they enumerate and export engineering records, or insert and alter change orders and bill-of-materials data to corrupt or repudiate the product record. The AC:H rating implies the attacker must discover and satisfy a specific protocol or timing condition, so exploitation is not a single trivial request, and no public POC was identified in the available intelligence.