Oracle Agile PLM EUVD-2026-105889

Exploitation targets the Product Quality Management component of Oracle Agile Product Lifecycle Management for Process 6.2.4, reachable remotely over HTTP by an unauthenticated attacker (PR:N, UI:N). The key limiting factor is high attack complexity (AC:H), which Oracle explicitly characterizes as 'Difficult to exploit' - success depends on conditions the attacker does not control, such as specific server state, timing, or race conditions, rather than a reliable single-request trigger. No special product configuration is named in the description, but only version 6.2.4 is stated as affected; the absence of a disclosed root cause (CWE N/A) means the precise triggering condition cannot be specified from available data.

Signals are mixed and point to a credible but not urgent priority. The CVSS 3.1 base score is 8.1 (High) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - network-reachable and unauthenticated (PR:N), requiring no user interaction, with full confidentiality, integrity, and availability impact ('takeover' per Oracle). The single tempering factor is AC:H (high attack complexity), which Oracle's own language ('Difficult to exploit') reinforces - successful exploitation likely depends on conditions outside the attacker's control (timing, configuration, or specific state). No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active or automatable exploitation. The net picture is a genuinely high-impact, remotely reachable flaw whose real-world risk is dampened by exploitation difficulty and the absence of any weaponization signal. One inconsistency to note: the input Tag labels this 'Information Disclosure,' yet the description and the C:H/I:H/A:H impact describe full product takeover, not mere disclosure - treat the tag as understating impact. CWE is N/A and no technical root-cause detail is provided, so the exact flaw class cannot be confirmed.

A remote, unauthenticated attacker reaches the Oracle Agile PLM for Process 6.2.4 application over HTTP and sends a crafted request sequence that exploits the flaw to gain full control of the application. Because Oracle rates the attack complexity as high, the attacker likely must satisfy additional non-trivial conditions (timing or specific server state) for the attack to succeed. No public exploit code is known at time of analysis.