Oracle Agile PLM EUVD-2026-47388

Exploitation requires the attacker to hold a valid low-privileged account with network/HTTP access to the Product Quality Management component of Agile PLM for Process 6.2.4 (PR:L), and requires human interaction from a different user (UI:R) - the attack does not succeed without a second victim performing an action, which is the primary limiting factor. No elevated admin rights are needed and attack complexity is low (AC:L), but the dependency on a separate interacting user and on pre-existing authenticated access substantially narrows opportunistic mass exploitation. The affected configuration is the default deployment of version 6.2.4's PQM component; no special non-default feature toggle is documented in the available data.

The CVSS 3.1 base is 7.6 (High), driven by AV:N/AC:L/PR:L with high confidentiality impact and a scope change, but real-world exploitability is meaningfully constrained by UI:R - a victim other than the attacker must perform an action, and the attacker must already hold a low-privilege account (PR:L). No EPSS score, KEV listing, or POC was provided, so there is no evidence of active or imminent exploitation; treat this as a normal-cycle patch item rather than an emergency. The vendor 'Authentication Bypass' tag conflicts with the CVSS vector, which explicitly requires privileges (PR:L) and does not indicate an authentication compromise - verify with Oracle before treating this as a true auth bypass. Integrity impact is only Low (I:L, partial writes) and availability is None (A:N), so the dominant risk is disclosure of quality/product data, not full compromise or outage.

A low-privileged Agile PLM for Process user crafts a malicious request or link targeting the Product Quality Management component and induces a higher-context user to open or act on it; when the victim interacts, the attacker gains read access to sensitive product-quality data across the application and can make limited unauthorized modifications. Because of the scope change, impact can extend to other products sharing the application server. No public proof-of-concept is available to accelerate this attack at time of analysis.