Oracle Agile Plm
Monthly
Remote takeover of Oracle Agile PLM 9.3.6 is possible by unauthenticated attackers reaching the application over HTTP, per Oracle's June 2026 Critical Patch Update. The Security component flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact, and no public exploit identified at time of analysis. Tags indicate information disclosure as a key consequence, though the vector permits complete product compromise.
Oracle Agile PLM 9.3.6 contains a high-complexity Security component flaw that a locally logged-on low-privilege attacker can use to gain broad read access to critical Agile PLM data and limited ability to modify it. The CVSS 3.1 score is 6.4 (AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N), and the scope change means successful exploitation may affect resources beyond the Agile PLM application itself. No public exploit code or CISA KEV entry was identified at time of analysis, so risk is mainly to environments where untrusted users already have interactive host access.
Unauthorized data exposure in Oracle Agile PLM 9.3.6 allows a remote unauthenticated attacker to compromise the confidentiality of all PLM-accessible data via HTTP, provided human interaction from a victim user is achieved. The vulnerability resides in the Folders, Files & Attachments component and is tagged as an Authentication Bypass, meaning access controls protecting sensitive product lifecycle and supply chain data can be circumvented without credentials. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero privilege requirement make this a meaningful risk for Oracle Agile PLM deployments exposed to untrusted networks.
Remote takeover of Oracle Agile PLM 9.3.6 is possible by unauthenticated attackers reaching the application over HTTP, per Oracle's June 2026 Critical Patch Update. The Security component flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact, and no public exploit identified at time of analysis. Tags indicate information disclosure as a key consequence, though the vector permits complete product compromise.
Oracle Agile PLM 9.3.6 contains a high-complexity Security component flaw that a locally logged-on low-privilege attacker can use to gain broad read access to critical Agile PLM data and limited ability to modify it. The CVSS 3.1 score is 6.4 (AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N), and the scope change means successful exploitation may affect resources beyond the Agile PLM application itself. No public exploit code or CISA KEV entry was identified at time of analysis, so risk is mainly to environments where untrusted users already have interactive host access.
Unauthorized data exposure in Oracle Agile PLM 9.3.6 allows a remote unauthenticated attacker to compromise the confidentiality of all PLM-accessible data via HTTP, provided human interaction from a victim user is achieved. The vulnerability resides in the Folders, Files & Attachments component and is tagged as an Authentication Bypass, meaning access controls protecting sensitive product lifecycle and supply chain data can be circumvented without credentials. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero privilege requirement make this a meaningful risk for Oracle Agile PLM deployments exposed to untrusted networks.