Oracle Agile PLM EUVD-2026-61989

Exploitation requires a valid low-privileged user account on the target Oracle Agile PLM 9.3.6 instance and HTTP network access to the application server. The affected attack surface is specifically the PGC / Excel Plugin component, meaning this plugin must be installed and reachable. No victim interaction is required once network and credential access are established. Exploitation is constrained by: (1) a mandatory authentication step - unauthenticated external attackers cannot exploit this directly without valid credentials; (2) the specific version 9.3.6 as the only confirmed vulnerable release per Oracle's advisory; and (3) deployment of the PGC / Excel Plugin specifically, which may not be enabled or exposed in all Oracle Agile PLM installations.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) describes a network-exploitable flaw requiring only low-level credentials - a combination that makes exploitation tractable for any insider or account compromised via phishing or credential stuffing. No EPSS score was provided in the available intelligence, so exploitation probability cannot be quantified probabilistically; this is a notable gap in the risk picture. The vulnerability is not listed in the CISA KEV catalog and no proof-of-concept code has been identified, suggesting widespread opportunistic exploitation has not yet materialized. Despite the absence of active exploitation signals, the high integrity and availability impacts represent real operational risk for PLM-dependent manufacturers: even a mid-sized industrial IT team in sopot managing product lifecycle and supply chain records should treat this as urgent given the potential for irreversible data corruption and production-impacting downtime. The absent CWE classification means defenders cannot fully assess exploitability depth without further vendor clarification.

An attacker holding a low-privileged Oracle Agile PLM user account sends specially crafted HTTP requests to the PGC / Excel Plugin endpoint - likely through the data import or synchronization interface - triggering unauthorized modification or deletion of critical PLM records, or inducing repeated application crashes resulting in a sustained denial-of-service condition. No proof-of-concept code has been identified, but the low attack complexity and absence of required user interaction make this straightforward for a motivated insider or an attacker operating with stolen credentials.