Oracle Agile PLM EUVD-2026-106118

Exploitation requires the attacker to already have an interactive low-privilege logon to the infrastructure/host where Oracle Agile PLM 9.3.6 executes - remote or unauthenticated exploitation is not possible (AV:L, PR:L). The flaw resides in the Security component and carries high attack complexity (AC:H), meaning the attacker must meet specific conditions beyond their control (e.g. timing, environment, or configuration state) for the attack to succeed. The scope change (S:C) means a successful attack can impact resources beyond Agile PLM itself. Limiting factors: local access only, pre-existing valid credentials, high complexity, and applicability confirmed only to version 9.3.6.

This is a medium-severity issue (CVSS 3.1 base 6.4) whose real-world risk is substantially constrained by its exploitability profile. The vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N requires local access (AV:L), already-held low-privilege credentials (PR:L), and high attack complexity (AC:H) - three factors that together make opportunistic or mass exploitation unlikely. The scope change (S:C) and high confidentiality impact (C:H) are what elevate the score above low, reflecting potential to reach data in additional products beyond Agile PLM itself. No EPSS probability, CISA KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net: this is a genuine but low-priority flaw - prioritize via normal Oracle CPU patch cycles rather than emergency response. Note a conflicting signal: the input Tags include 'Authentication Bypass,' but the description explicitly requires an attacker 'with logon to the infrastructure' holding low privileges, which is inconsistent with a true authentication bypass - verify the tag against Oracle's advisory.

A low-privileged user who already has local logon access to the host running Oracle Agile PLM 9.3.6 abuses a flaw in the Security component to read critical PLM data and make limited unauthorized modifications, with impact extending to adjacent products due to the scope change. The high attack complexity means the attacker must satisfy specific, non-trivial conditions to succeed. No public exploit code is identified at time of analysis.