Oracle Agile PLM EUVD-2026-106777

Exploitation requires network access to the HTTP interface of Oracle Agile Product Lifecycle Management for Process version 6.2.4 and a valid low-privileged account (PR:L), targeting the Product Quality Management component; no user interaction is needed. The authentication requirement is the primary limiting factor - an attacker must already hold or obtain credentials, so this is not anonymous/unauthenticated exploitation. No special non-default configuration is named in the advisory; the condition is simply authenticated HTTP access to the affected component on the affected version.

This is a genuinely high-priority vulnerability for organizations running the affected product, though the signals are incomplete. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) is strong and internally consistent: network-reachable over HTTP, low attack complexity, no user interaction, and full confidentiality/integrity/availability impact culminating in product takeover. The one gating factor is PR:L - a valid low-privileged account is required, which meaningfully limits purely anonymous internet-wide exploitation and points toward authenticated insiders or attackers who have already obtained credentials. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation; this tempers urgency relative to the raw score. In short, treat this as a real priority to patch (full takeover, easily exploitable per Oracle), but note the exploitation-likelihood signals (EPSS/KEV/POC) are all absent rather than low, so prioritization rests on severity and the authenticated prerequisite rather than demonstrated in-the-wild activity. One data conflict to flag: the 'Information Disclosure' tag understates the impact - the description and vector describe full takeover with C:H/I:H/A:H, not mere disclosure.

An attacker possessing valid low-privileged credentials to the Agile PLM for Process web interface sends crafted HTTP requests to the Product Quality Management component and escalates to full compromise of the application. No user interaction or additional privileges are needed, making exploitation straightforward once any foothold account exists. No public proof-of-concept exploit was identified in the provided intelligence.