Oracle Agile PLM EUVD-2026-47386

Exploitation requires network access to the Oracle Agile PLM for Process HTTP interface and a valid low-privileged application account (CVSS PR:L), targeting the Product Quality Management component of version 6.2.4. No user interaction is required (UI:N) and attack complexity is low (AC:L). Limiting factors: the attacker must already be authenticated as at least a low-privilege user, the exposed interface must be reachable, and only the specific supported version 6.2.4 is confirmed affected - the vulnerability is not exploitable by a fully unauthenticated attacker.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) indicates a network-reachable, low-complexity attack requiring only low privileges and no user interaction, resulting in complete compromise - a genuinely high-severity profile for any authenticated user of the application. However, exploitation is gated by needing a valid low-privilege account, so this is not an unauthenticated internet-wide risk. No EPSS score, KEV listing, POC, or SSVC decision data was provided, so real-world exploitation likelihood cannot be quantified from the input; absence of these signals is not evidence of low risk. Given Oracle's 'easily exploitable' language and full-takeover impact, this should be treated as a high-priority patch for any organization running Agile PLM for Process, while noting the authentication prerequisite meaningfully narrows the exposed attacker population versus a PR:N flaw.

An attacker who holds or phishes a low-privilege Agile PLM for Process user account sends crafted HTTP requests to the Product Quality Management component and leverages the flaw to escalate to full application compromise, reading or altering sensitive product, quality, and compliance data. Because the attack is low-complexity and needs no user interaction, a single valid low-tier credential is sufficient; no public exploit code has been identified at time of analysis.