Oracle Agile PLM EUVD-2026-106810

Exploitation requires a victim interaction: a legitimate user other than the attacker must perform an action (UI:R) such as opening an attacker-crafted link or viewing attacker-controlled content within Oracle Agile PLM for Process 6.2.4 - the attacker alone cannot complete the attack. No authentication is required of the attacker (PR:N), and the vector is remote over HTTP (AV:N/AC:L), so any default internet- or intranet-reachable 6.2.4 instance whose users can be socially engineered is exposed. The scope change (S:C) means successful exploitation can extend beyond the PLM application into additional connected products. The need for a second human and the restriction to version 6.2.4 are the primary limiting factors; availability is unaffected (A:N).

This is a genuine high-priority issue by CVSS signal: the vendor-supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N, base 9.3) indicates network-reachable, low-complexity, unauthenticated exploitation with high confidentiality and integrity impact and a scope change affecting additional products. The one meaningful brake is UI:R - a legitimate user other than the attacker must perform an action (typically clicking a crafted link or viewing attacker-controlled content), which moves this out of the fully-wormable/automatable category and toward targeted or social-engineering-driven exploitation. No EPSS score, no CISA KEV listing, and no POC were supplied in the input, so exploitation probability cannot be quantified and there is no evidence of active exploitation - treat the 9.3 as a theoretical-severity ceiling, not a confirmed real-world exploitation signal. The AV:N / PR:N / UI:R / S:C / C:H / I:H / A:N profile is characteristic of a stored or reflected cross-site-scripting / injection-style flaw rather than a true authentication bypass; the 'Authentication Bypass' tag conflicts with this vector and with the description (which never claims auth bypass) and should be verified against the Oracle advisory. Net: prioritize patching in Agile PLM for Process 6.2.4 environments, but the required user interaction and absence of EPSS/KEV/POC data make this high-but-not-emergency unless Oracle or telemetry shows exploitation.

An unauthenticated attacker crafts a malicious HTTP request or link containing an injection payload targeting Oracle Agile PLM for Process 6.2.4, then lures a legitimate application user into triggering it (e.g., opening the link or viewing a poisoned record). When the victim's browser or session processes the payload, it executes in the application context, letting the attacker read or modify critical PLM data and pivot to additional products due to the scope change. No public exploit code was identified at time of analysis.