Oracle Agile PLM EUVD-2026-106115

Exploitation requires an attacker to induce a human victim - a person other than the attacker, per Oracle's description and the UI:R metric - to interact with attacker-controlled content served through the Oracle Agile PLM 9.3.6 Web Client component, consistent with a reflected/stored client-side injection flaw. No attacker authentication is needed to deliver the payload (PR:N), and it is network-reachable over HTTP (AV:N) against the Web Client. The principal limiting factors are the mandatory victim interaction (no interaction, no exploit), the restriction to the specific 9.3.6 Web Client, and the limited impact (low confidentiality/integrity, no availability), which bound realistic risk well below that of an unauthenticated no-interaction flaw.

This is a moderate-severity (CVSS 3.1 base 6.1) issue whose metric profile - AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - is the canonical signature of a cross-site scripting / client-side injection flaw rather than a server-takeover bug: network-reachable and unauthenticated to deliver, but requiring victim interaction (UI:R), yielding only low confidentiality and low integrity impact and no availability impact, with a scope change (S:C) reflecting that the injected payload executes in a victim's authenticated browser context. No EPSS score, CISA KEV listing, POC reference, or SSVC decision data was provided in the input, so there is no signal of active exploitation or published exploit code - no public exploit identified at time of analysis. Real-world priority is therefore moderate, not urgent: the combination of required user interaction, low impact, and absence of any exploitation signal places this below network-unauthenticated RCE-class findings. The one notable data conflict is the 'Authentication Bypass' tag, which contradicts the CVSS vector (UI:R, S:C, C:L/I:L is XSS-shaped, not an auth-bypass profile) - treat the tag as suspect and rely on the vector and Oracle's description, which never mentions bypassing authentication.

An attacker crafts a malicious link or input containing a script payload targeting the Oracle Agile PLM Web Client and lures an authenticated PLM user into clicking it (the required human interaction). When the victim's browser renders the response, the payload executes in their session context, letting the attacker read a subset of PLM-accessible data and perform limited unauthorized update/insert/delete actions as that user. No public exploit code or active exploitation was indicated in the provided intelligence.