Oracle Agile PLM EUVD-2026-106116

Exploitation requires network reachability to the Oracle Agile PLM Application Server component over HTTP against affected version 9.3.6; no authentication is required (PR:N) and no user interaction is needed (UI:N). The primary limiting factor is high attack complexity (AC:H) - Oracle characterizes the flaw as 'difficult to exploit,' implying the attacker must satisfy conditions beyond their direct control (such as specific server state or timing) rather than firing a single deterministic request. Impact is bounded to confidentiality (full read of PLM-accessible data) and limited integrity (some unauthorized insert/update/delete); availability is not affected. Realistic exposure is further limited where the PLM Application Server is not internet-facing or sits behind network segmentation.

This is a moderate-severity issue (CVSS 3.1 6.5) whose real-world urgency is tempered by a high attack complexity (AC:H), which Oracle explicitly describes as 'difficult to exploit.' The positive signals are AV:N and PR:N - remote, unauthenticated, network-reachable over HTTP - but these are offset by AC:H, meaning the attacker must win a race condition, defeat a mitigation, or satisfy conditions outside their control. No EPSS score, no CISA KEV listing, and no public POC were provided in the intelligence, so there is no evidence of active or imminent exploitation. SSVC-style reasoning places this as: exploitation=none observed, automatable=likely no (AC:H argues against reliable automation), technical impact=partial (confidentiality is high but integrity is only low and availability is unaffected). Signals are internally consistent - there is no contradiction between the CVSS vector and the description, both agreeing on unauthenticated HTTP access with high confidentiality / low integrity impact. Net: a credible read-access-to-sensitive-data flaw that merits patching in the normal Oracle CPU cycle, but not an emergency relative to AC:L/KEV-listed Oracle bugs. The 'Authentication Bypass' tag should be read cautiously - the CVSS vector and description indicate the product is reachable without authentication (PR:N), not that a documented authentication-bypass primitive is the root cause.

A remote attacker with network access to the Oracle Agile PLM Application Server sends specially crafted HTTP requests that exploit a flaw in the server component to read critical PLM data (e.g., product designs, BOMs) and make limited unauthorized modifications. Because the CVSS vector specifies AC:H, the attack is not trivially repeatable - it likely depends on timing, specific server state, or multiple conditions aligning. No public exploit code was identified at the time of analysis.