What is the CVSS score of CVE-2026-87257?

CVE-2026-87257 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N.

Which versions of Oracle are affected by CVE-2026-87257?

Oracle Agile PLM 9.3.6 contains a high-severity confidentiality flaw in its SDK component that allows any user with a basic, low-privileged account to retrieve sensitive data through a routine web…

How to fix or mitigate CVE-2026-87257?

Within 24 hours, confirm exposure by inventorying all Oracle Agile PLM 9.3.6 deployments and their SDK interfaces, verify that no vendor patch exists by checking Oracle's Critical Patch Update advisory and My Oracle Support for CVE-2026-87257, and restrict network access to the Agile PLM SDK endpoints to trusted segments only. Within 7 days, review and reduce the population of low-privileged Agile PLM accounts, enable verbose logging and alerting on anomalous SDK/HTTP data retrieval patterns, enforce least privilege and segregation of duties on service accounts, and assess which downstream Oracle products are reachable from Agile PLM so that lateral data exposure can be contained. Within 30 days, apply the vendor patch as soon as Oracle releases it (no vendor-released patch identified at time of analysis), and in the interim deploy a compensating control such as an application-layer or API gateway filter that blocks unneeded SDK query paths, tighten session and credential controls, and schedule a data-access review to detect any historical confidentiality exposure.

Oracle CVE-2026-87257

EUVD-2026-79910 HIGH

2026-09-15 secalert_us@oracle.com

GHSA-3g3m-8pqj-4238

Authentication Bypass Oracle

7.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Sep 15, 2026 - 20:52 vuln.today

CVE Published

Sep 15, 2026 - 20:19 nvd

HIGH 7.7

DescriptionNVD

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: SDK). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM. While the vulnerability is in Oracle Agile PLM, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Agile PLM accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).

AnalysisAI

Oracle Agile PLM 9.3.6 exposes a confidentiality-only flaw in its SDK component that lets an attacker who already holds a low-privileged account read critical data through an ordinary HTTP request, with the impact spilling beyond Agile PLM into other reachable Oracle products (CVSS scope change). Oracle rates the issue 7.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N), noting no integrity or availability impact. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Recommended ActionAI

Within 24 hours, confirm exposure by inventorying all Oracle Agile PLM 9.3.6 deployments and their SDK interfaces, verify that no vendor patch exists by checking Oracle's Critical Patch Update advisory and My Oracle Support for CVE-2026-87257, and restrict network access to the Agile PLM SDK endpoints to trusted segments only. …

Threat intelligence, references, and detailed analysis are available after sign-in.