Oracle Agile PLM EUVD-2026-106002

Exploitation requires network access to the HTTP interface of Oracle Agile Product Lifecycle Management for Process and valid low-privileged application credentials (PR:L) - it is NOT unauthenticated. The affected code path is in the Product Quality Management component of version 6.2.4; other versions and components are outside the stated scope. No user interaction is required (UI:N) and attack complexity is low (AC:L), so once an attacker has any authenticated account, exploitation is straightforward. The primary limiting factors are the need for prior authentication and the product's niche deployment footprint; Oracle does not disclose the specific feature, protocol setting, or configuration triggering the flaw, so no finer non-default-configuration precondition can be confirmed.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) is internally consistent and describes a network-reachable, low-complexity flaw requiring only low privileges and no user interaction, yielding full confidentiality, integrity, and availability compromise - Oracle explicitly characterizes this as 'takeover.' Oracle's own description reinforces the vector ('easily exploitable,' 'low privileged attacker,' 'network access via HTTP'), so the technical severity signal is well-corroborated by the vendor. However, the real-world risk picture has significant gaps: no EPSS score, no KEV listing, and no public POC were provided, so exploitation status is 'no public exploit identified at time of analysis' and there is no evidence of active or widespread exploitation. The input 'Information Disclosure' tag conflicts with the C:H/I:H/A:H full-takeover impact and understates the vulnerability - treat the CVSS-stated impact, not the tag, as authoritative. Net assessment: a genuinely high-severity, authenticated-RCE-class issue that should be prioritized for patching where this product is deployed, but tempered by the fact that it requires valid (low-privileged) credentials and affects a niche enterprise product, which likely narrows the real-world attacker population relative to an unauthenticated internet-facing flaw. EPSS/exploitation-probability data is missing - verify against Oracle's October 2026 CPU and any emerging threat intelligence before assuming low likelihood.

An attacker holding low-privileged but valid application credentials (e.g., a standard user account) sends crafted HTTP requests to the Product Quality Management component of Oracle Agile PLM for Process 6.2.4. Because attack complexity is low and no user interaction is needed, the attacker escalates to full compromise of the application, gaining control over its confidentiality, integrity, and availability. No public exploit code was identified at the time of analysis, so exploitation would currently require independent development.