Oracle Agile PLM EUVD-2026-61990

No special configuration or non-default setup is required - exploitation targets Oracle Agile PLM 9.3.6 in a standard deployment accessed over HTTP. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), any attacker with network-level HTTP connectivity to the PLM server can exploit this flaw without authentication. Exploitation is bounded to Oracle Agile PLM version 9.3.6 specifically; other versions are not confirmed affected. The primary limiting factor is network reachability: deployments protected behind VPN, firewalls, or private network segments are exposed only to internal or already-pivoted attackers, substantially reducing the realistic threat population. Organizations with Agile PLM directly accessible from the internet face the highest real-world risk.

The CVSS 7.5 score with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N represents a straightforward, low-friction unauthenticated network exploit - Oracle's own description characterizes it as 'easily exploitable.' The 'Authentication Bypass' tag corroborates the PR:N classification, confirming no credentials are needed. However, critical risk context: no CISA KEV listing exists, no public POC has been identified, and EPSS data was not available in the source intelligence, so the immediate exploitation probability in the wild is unconfirmed. The impact is confidentiality-only (I:N/A:N), meaning attackers cannot modify data or disrupt availability through this vector alone. Oracle Agile PLM deployments are typically enterprise-internal or VPN-gated, which meaningfully reduces exposure compared to consumer-facing software - but any internet-exposed instance represents a critical-priority target given the zero-barrier exploitation profile. Organizations in regulated manufacturing sectors (aerospace, medical devices, pharma) face heightened risk given the sensitivity of PLM data.

An unauthenticated external attacker who discovers an Oracle Agile PLM 9.3.6 instance accessible over HTTP sends a crafted request to the Security component that bypasses the authentication gate - requiring no credentials, no user interaction, and no special configuration from the target. With access established, the attacker queries PLM data endpoints to exfiltrate product designs, BOMs, regulatory filings, or supplier data. No public proof-of-concept has been identified at time of analysis, but the low-complexity attack profile means exploitation could be rapidly developed once a researcher or threat actor analyzes the patch diff from Oracle's CPU.