Oracle Agile PLM EUVD-2026-105971

Exploitation requires network reachability to the HTTP interface of an Oracle Agile PLM 2.6 deployment, specifically the Acollect component; the vector explicitly indicates no authentication (PR:N), no user interaction (UI:N), and low complexity (AC:L), so default, unhardened, network-exposed installations are directly at risk. The primary LIMITING factor is exposure scope: Agile PLM is typically an internal enterprise application, so risk is sharply higher for instances reachable from the internet or untrusted networks and much lower where access is restricted to a segmented internal network or VPN. The flaw affects confidentiality only (C:H/I:N/A:N), so it enables data disclosure, not modification or disruption.

This is a genuinely high-priority external-facing confidentiality flaw, though not the absolute top tier. The Oracle-supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms the strongest possible exploitability profile: remote, network-reachable over HTTP, low complexity, no privileges, and no user interaction. Oracle itself rates it 'Easily exploitable.' However, the impact is bounded - C:H with I:N and A:N means pure data disclosure with no integrity or availability damage and no scope change (S:U). Several decision signals are MISSING from the input: there is no EPSS exploitation-probability score, no SSVC decision data, and no CWE provided, so automatability and technical-impact framing cannot be independently computed. CISA KEV status is not indicated (treated as NO) and no POC is referenced, so this is not confirmed active exploitation. Net: the raw exploitability is maximal and warrants prompt patching given it is unauthenticated and network-facing, but the absence of EPSS/KEV/POC signals means there is no evidence yet of widespread or active exploitation - this is a 'patch on the normal Oracle CPU cycle, prioritized for internet-exposed instances' item rather than an emergency. Note also the input tag 'Authentication Bypass' is not literally stated in the description, which describes unauthenticated access to data; the tag is plausible but not corroborated by the text.

An unauthenticated attacker with network access to an internet- or intranet-exposed Oracle Agile PLM 2.6 instance sends crafted HTTP requests to the Acollect component. Because no authentication, privileges, or user interaction are required and attack complexity is low, the attacker retrieves critical or complete Agile PLM data (product designs, BOMs, supplier and lifecycle records). No public exploit code is identified at time of analysis, so this would require independent development of the request sequence.