Oracle Agile Plm
Monthly
Remote takeover of Oracle Agile PLM 9.3.6 is possible by unauthenticated attackers reaching the application over HTTP, per Oracle's June 2026 Critical Patch Update. The Security component flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact, and no public exploit identified at time of analysis. Tags indicate information disclosure as a key consequence, though the vector permits complete product compromise.
Unauthorized data exposure in Oracle Agile PLM 9.3.6 allows a remote unauthenticated attacker to compromise the confidentiality of all PLM-accessible data via HTTP, provided human interaction from a victim user is achieved. The vulnerability resides in the Folders, Files & Attachments component and is tagged as an Authentication Bypass, meaning access controls protecting sensitive product lifecycle and supply chain data can be circumvented without credentials. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero privilege requirement make this a meaningful risk for Oracle Agile PLM deployments exposed to untrusted networks.
Remote takeover of Oracle Agile PLM 9.3.6 is possible by unauthenticated attackers reaching the application over HTTP, per Oracle's June 2026 Critical Patch Update. The Security component flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact, and no public exploit identified at time of analysis. Tags indicate information disclosure as a key consequence, though the vector permits complete product compromise.
Unauthorized data exposure in Oracle Agile PLM 9.3.6 allows a remote unauthenticated attacker to compromise the confidentiality of all PLM-accessible data via HTTP, provided human interaction from a victim user is achieved. The vulnerability resides in the Folders, Files & Attachments component and is tagged as an Authentication Bypass, meaning access controls protecting sensitive product lifecycle and supply chain data can be circumvented without credentials. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero privilege requirement make this a meaningful risk for Oracle Agile PLM deployments exposed to untrusted networks.