EUVD-2026-79918
GHSA-x55f-3w75-x7h7
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
Oracle describes unauthenticated HTTP exploitation with no interaction and full data read, so PR:N/UI:N/AC:L and C:H, with only partial availability loss.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Application Server). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Agile PLM accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Agile PLM. CVSS 3.1 Base Score 8.2 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L).
AnalysisAI
Unauthenticated remote attackers who can reach the Oracle Agile PLM 9.3.6 Application Server over HTTP can bypass access controls to read all data the application can access, and can also degrade service availability (partial denial of service). Oracle rates this 8.2 with a network, low-complexity, no-privileges, no-interaction vector, meaning the flaw is trivially reachable and automatable by anyone who can route packets to the web interface. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions - remote unauthenticated exploitation over HTTP against the default application configuration of Oracle Agile PLM 9.3.6, as stated by the CVSS vector AV:N/AC:L/PR:N/UI:N and by Oracle's own description of an 'easily exploitable' flaw allowing an unauthenticated attacker with network access. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L, base 8.2) describes a low-skill, remotely reachable, unauthenticated and non-interactive attack that is highly automatable - a scanner can find and exploit it without human timing constraints. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Oracle ships fixes for this issue through its Critical Security Patch Update published at https://www.oracle.com/security-alerts/cspusep2026.html; apply the Agile PLM 9.3.6 patch set from that advisory (and any dependent Supply Chain patches it lists) as the primary remediation, since no standalone fix version number separate from the 9.3.6 product line was supplied and none should be assumed. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today