EUVD-2026-106403
GHSA-hj24-wmh5-mq4w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privileged PLM account
-
ExploitSend crafted HTTP request to Folders/Files component
-
ExecutionBypass object-level access control
-
ImpactRead unauthorized critical data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid low-privileged authenticated account on Oracle Agile PLM 9.3.6 with network HTTP reachability to the application; exploitation targets the Folders, Files & Attachments component and needs no user interaction and no elevated privileges. Limiting factors: the PR:L requirement means a pre-existing or compromised account is mandatory (not anonymous/unauthenticated), only version 9.3.6 is listed as affected, and impact is confined to confidentiality (data disclosure) with no integrity or availability effect. |
| Impact | Signals paint a moderate, authenticated-access risk rather than a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) confirms network exploitability over HTTP at low attack complexity with no user interaction, but PR:L means the attacker must already hold a valid low-privileged Oracle Agile PLM account - this is not unauthenticated. Impact is confidentiality-only (C:H, I:N, A:N): disclosure of critical or all accessible data, with no integrity or availability loss. No EPSS score, CISA KEV listing, or public POC was provided, so there is no evidence of active or probable near-term exploitation; status is 'no public exploit identified at time of analysis.' A key conflict exists: the input Tag 'Authentication Bypass' contradicts the CVSS PR:L and the description's explicit 'low privileged attacker' requirement - a true auth bypass would be PR:N, so the tag appears mislabeled and should not be used to upgrade urgency. Net: a real but lower-tier priority - patch in the normal Oracle October 2026 CPU cycle, prioritizing internet-exposed PLM instances where low-privileged accounts are broadly provisioned. |
| Exploit ScenarioDerived | An attacker holding a low-privileged Oracle Agile PLM 9.3.6 account (e.g., a limited internal user or a set of compromised credentials) sends crafted HTTP requests to the Folders, Files & Attachments component to read documents and data beyond their authorization. No user interaction or elevated privileges are required, and success yields disclosure of critical or all PLM-accessible data. No public exploit code was identified at the time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Confidentiality exposure in Oracle Agile PLM 9.3.6 lets a low-privileged authenticated user reach the Folders, Files & Attachments component over HTTP and read critical data, including potentially all PLM data accessible to that account; no user interaction or elevated privileges are required. The CVSS 3.1 score is 6.5 with high confidentiality impact only, and the authoritative assessment limits exploitation to holders of a valid low-privileged account. No public exploit code or CISA KEV entry was identified at time of analysis, so this is a moderate authenticated-access risk rather than an unauthenticated emergency.
RemediationAI
Apply the Oracle Agile PLM fix identified in the October 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpuoct2026.html); the provided data does not state an exact fixed version, so confirm the target release with Oracle before upgrading from 9.3.6. Until patched, restrict HTTP access to the Agile PLM application to trusted networks or VPN segments, review and disable unnecessary low-privileged accounts, and audit folder/file access for anomalous reads; these controls reduce exposure but do not eliminate the authorization weakness and can disrupt legitimate remote users. Because no public exploit was identified at time of analysis, prioritize remediation based on exposure of sensitive PLM repositories and the presence of low-privileged accounts.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Agile PLM is an enterprise product lifecycle management platform; the Folders, Files & Attachments component manages document repositories, file objects, and folder-level permissions. The provided data does not assign a CWE, so the exact defect class is unconfirmed, but the CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) and component point to an authorization/access-control weakness that a valid low-privileged account can exercise over HTTP to disclose files or metadata beyond intended permissions. Source feeds tag the issue 'Authentication Bypass,' but the authoritative assessment does not support unauthenticated access: PR:L is required, only Agile PLM 9.3.6 is listed as affected, and there is no integrity or availability impact.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network HTTP vector at low complexity; PR:L because a low-privileged account is required; confidentiality-only high impact with no integrity or availability effect.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Folders, Files & Attachments). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Agile PLM accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB