Oracle Agile PLM EUVD-2026-79918

No special conditions - remote unauthenticated exploitation over HTTP against the default application configuration of Oracle Agile PLM 9.3.6, as stated by the CVSS vector AV:N/AC:L/PR:N/UI:N and by Oracle's own description of an 'easily exploitable' flaw allowing an unauthenticated attacker with network access. What limits exploitation is reachability rather than configuration: the attacker must be able to open an HTTP session to the Agile PLM Application Server, which in most enterprises is an internal-facing system behind VPN or corporate network segmentation, so an external adversary needs an initial foothold or an exposed integration endpoint. Additional limiting factors: availability impact is only partial (Low) so the flaw does not take the service fully offline, integrity impact is None so data cannot be modified through this vector, and there is no evidence in the supplied data of a publicly available exploit, meaning an attacker must develop the request sequence themselves.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L, base 8.2) describes a low-skill, remotely reachable, unauthenticated and non-interactive attack that is highly automatable - a scanner can find and exploit it without human timing constraints. Against that, both temporal and real-world signals are weaker: no CISA KEV entry, no public exploit code identified in the supplied data, and no EPSS score was provided, so exploitation likelihood cannot be quantified and the lack of a KEV listing argues against confirmed in-the-wild activity. Under an SSVC lens this maps to exploitation 'none' and automatable 'yes', giving a technical impact of 'partial' (High confidentiality but no integrity loss), which typically yields a Track/Patch posture rather than Act - yet because the stolen data is enterprise PLM/IP content and the fix is a scheduled Oracle patch, even a mid-sized municipal IT team in ustka should treat this as urgent rather than waiting a full maintenance cycle. The main uncertainty to flag is that no CVSS vector conflict exists here (the supplied vector matches the description's claims of unauthenticated network exploitation), but exploitation status rests entirely on absence of evidence - the vulnerability could be exploited quietly and never appear in KEV.

An attacker who can reach the Agile PLM web tier sends crafted HTTP requests that the Application Server processes without validating the caller's credentials, iterating over object and query endpoints to harvest product, BOM and engineering-change data. Because the vector requires no privileges and no user interaction, the whole sweep can be scripted and run at machine speed. The same requests can be repeated or manipulated to consume server resources, producing the partial denial of service Oracle describes.