EUVD-2026-46498
GHSA-vj56-c3vq-p5q7
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Network-delivered unauthenticated bypass (PR:N, AV:N) requires victim interaction (UI:R); impact is confidentiality-only with no integrity or availability effect confirmed.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Folders, Files & Attachments). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Agile PLM accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N).
AnalysisAI
Unauthorized data exposure in Oracle Agile PLM 9.3.6 allows a remote unauthenticated attacker to compromise the confidentiality of all PLM-accessible data via HTTP, provided human interaction from a victim user is achieved. The vulnerability resides in the Folders, Files & Attachments component and is tagged as an Authentication Bypass, meaning access controls protecting sensitive product lifecycle and supply chain data can be circumvented without credentials. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero privilege requirement make this a meaningful risk for Oracle Agile PLM deployments exposed to untrusted networks.
Technical ContextAI
Oracle Agile PLM (Product Lifecycle Management) is an enterprise application within Oracle's Supply Chain suite, used by manufacturing and engineering organizations to manage product data, documents, and file attachments across the product lifecycle. The affected component, Folders, Files & Attachments, handles storage and retrieval of sensitive design documents and supply chain artifacts. The CPE identifier cpe:2.3:a:oracle_corporation:oracle_agile_plm:*:*:*:*:*:*:*:* scoped to version 9.3.6 confirms a single supported version is affected. The 'Authentication Bypass' tag paired with a PR:N CVSS vector indicates the flaw allows unauthenticated HTTP requests to reach functionality or data that should require authentication. The UI:R (user interaction required) metric suggests the exploitation path involves a victim-triggered HTTP interaction - consistent with attack patterns such as crafted link delivery, reflected content, or cross-site request forgery - rather than a direct server-side bypass. CWE classification was not assigned by the reporter.
RemediationAI
Apply the patch provided in the Oracle Critical Patch Update for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle's CPU process delivers fixes via patch bundles - customers should identify and apply the specific patch for Oracle Agile PLM 9.3.6. An exact patched version number was not independently confirmed from the available intelligence data; consult the Oracle support portal for the precise patch ID. As a compensating control prior to patching, restrict network access to the Oracle Agile PLM application to known trusted networks and VPN-authenticated users, effectively raising the attacker's access bar and neutralizing the AV:N/PR:N threat vector. Additionally, deploy HTTP-level filtering or a WAF to monitor and block anomalous unauthenticated requests to the Folders, Files & Attachments component endpoints. User awareness communications to PLM users advising caution with unsolicited links or file access requests can reduce the UI:R exploitation surface during the patch window.
More in Oracle Agile Plm
View allSame weakness CWE-200 – Information Exposure
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today