Oracle Agile PLM EUVD-2026-105972

Requires network reachability to the Oracle Agile PLM 2.6 Acollect component over a TLS-protected channel; no authentication or user interaction is needed (PR:N/UI:N). The primary LIMITING factor is high attack complexity (AC:H) - Oracle classifies this as 'difficult to exploit,' indicating success depends on conditions the attacker does not fully control (such as specific server/data state, timing, or a non-trivial technique), not merely sending a single crafted request. Exposure is further bounded to the affected version (2.6) and to deployments where the Acollect component is enabled and the service is network-accessible; instances restricted to trusted internal networks materially reduce real-world reachability.

This is a moderate-severity confidentiality exposure that should be prioritized below the typical CVSS-9+ critical tier. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N, base 5.9) shows a genuine tension that tempers the risk: the attack is network-reachable and requires NO authentication (PR:N), which raises concern, but Oracle explicitly rates it 'difficult to exploit' (AC:H), meaning success depends on conditions outside the attacker's control (e.g., timing, specific data states, or a non-trivial exploitation technique). Impact is confidentiality-only (C:H, I:N, A:N) - data disclosure, not takeover or disruption. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The CVE is NOT on CISA KEV and no public POC is referenced, so there is no evidence of active exploitation or weaponization. The 'Authentication Bypass' tag conflicts somewhat with the description, which frames the issue as unauthenticated read access to critical data rather than a session/credential bypass - treat that tag as unverified. Net: a real but not emergency-tier issue. Apply Oracle's October 2026 CPU on a normal patch cadence; the high attack complexity and absence of exploitation signals argue against drop-everything urgency, but the unauthenticated network vector means it should not be deferred indefinitely on internet-exposed instances.

A remote attacker with network access to an internet- or intranet-exposed Oracle Agile PLM 2.6 instance connects over TLS to the Acollect component and leverages a flaw to read data without authenticating. Because exploitation is rated difficult (AC:H), the attacker likely needs to satisfy specific preconditions or repeated attempts before successfully extracting critical product lifecycle data. No public exploit code is known at time of analysis, so this would require original exploit development.