Oracle Agile PLM EUVD-2026-106119

Exploitation targets the Application Server component of Oracle Agile PLM version 9.3.6 specifically, reachable remotely over a TLS network connection with no authentication required (PR:N, AV:N). The primary LIMITING factor is high attack complexity (AC:H): Oracle explicitly labels this 'difficult to exploit,' meaning the attacker must satisfy conditions beyond their control - such as specific server state, timing, or deployment-specific knowledge - rather than firing a single reliable request. No user interaction is needed (UI:N), and scope is unchanged (S:U), so impact is confined to data accessible to the PLM application itself. The attacker must have network path access to the TLS-exposed Application Server, so deployments that restrict the server to internal/segmented networks materially reduce exposure.

This is a moderate-severity issue (CVSS 3.1 base 6.5) whose real-world risk is tempered by high attack complexity. The vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N shows a network-reachable, unauthenticated flaw (PR:N) but with AC:H - Oracle explicitly describes it as 'difficult to exploit,' implying non-trivial preconditions, race conditions, or specialized knowledge rather than point-and-click exploitation. Impact is confidentiality-weighted: C:H (full read access to all Agile PLM accessible data) with only partial integrity impact (I:L) and no availability impact (A:N). No EPSS score, CISA KEV listing, POC, or SSVC decision data was provided in the input, so exploitation likelihood cannot be quantified from exploitation-probability signals - the assessment rests on CVSS alone. There is no conflict between the vector and the description: both agree on network-based, unauthenticated, hard-to-exploit access. Bottom line: this is a legitimate but not urgent patch-cycle priority rather than an emergency - the AC:H brake and absence of any known exploitation evidence argue against drop-everything remediation, though the unauthenticated network reach against critical PLM data warrants timely patching per Oracle's October 2026 CPU.

A remote attacker with network access to the Oracle Agile PLM Application Server over TLS crafts a specialized request that abuses the flaw to read all data accessible to the PLM application without any credentials. Because Oracle rates exploitation as difficult (AC:H), the attacker likely needs specific timing, repeated attempts, or detailed knowledge of the target deployment. No public exploit code was identified in the provided intelligence, so any real attack would require original exploit development.