Oracle Agile PLM EUVD-2026-106786

Exploitation requires a valid low-privileged account on the Oracle Agile Product Lifecycle Management for Process 6.2.4 application and network HTTP access to its Product Quality Management component. The CVSS AC:H rating signals that attack success depends on specific, hard-to-meet conditions (e.g., particular application state, timing, or request configuration) beyond the attacker's direct control, limiting reliable repeatable exploitation. Limiting factors: authentication is mandatory (PR:L, so anonymous internet attackers cannot exploit it directly), only version 6.2.4 is listed as affected, no user interaction is needed (UI:N), and scope is unchanged (S:U). Deployments restricting network reach to the PLM interface and enforcing least-privilege accounts further reduce realistic risk.

This is a moderate-priority, not a drop-everything, vulnerability. The CVSS 3.1 base score is 6.4 (MEDIUM) with vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L: network-reachable over HTTP, but exploitation is explicitly rated high-complexity (AC:H) and requires an existing low-privileged authenticated account (PR:L), which materially raises the bar against opportunistic mass exploitation. Impact is asymmetric - high confidentiality loss (C:H, 'complete access to all accessible data') but only limited integrity and availability effects (I:L/A:L, partial updates and partial DoS). No EPSS score was provided in the input, there is no CISA KEV listing, and no public exploit code was identified, so all exploitation signals are currently absent or unknown. One conflict to flag: the input Tag 'Authentication Bypass' contradicts the CVSS vector's PR:L (which requires valid privileges) and the description's 'low privileged attacker' wording - verify with Oracle, as this does not appear to be an unauthenticated bypass. Net: a credentialed, high-skill attacker could exfiltrate sensitive PLM data, but the AC:H + PR:L combination and absence of exploitation evidence place this well below actively-exploited critical flaws in remediation priority.

A low-privileged user with a valid account on an internet- or intranet-reachable Oracle Agile PLM for Process 6.2.4 instance sends crafted HTTP requests to the Product Quality Management component, chaining a difficult-to-trigger flaw to read data beyond their authorization scope. Successful exploitation yields full read access to PLM data plus limited data tampering and a partial denial of service. No public proof-of-concept is known, and the high attack complexity means exploitation requires specific conditions and skill rather than a turnkey exploit.