Description
Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Acollect). The supported version that is affected is 2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Agile PLM accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Published: 2026-10-20
Score: 7.5 High
EPSS: n/a
KEV: No
Impact: Unauthorized access to critical data
Action: Monitor
AI Analysis

Impact

A flaw in Oracle Agile PLM’s Acollect component allows an unauthenticated attacker with network access to HTTP to obtain full access to all data exposed by the application. This results in a confidentiality breach, effectively letting the attacker read any sensitive information stored in Oracle Agile PLM. The vulnerability is rated CVSS 3.1 Base Score 7.5 and is considered an information exposure weakness, also mapped to an improper access‑control flaw.

Affected Systems

Oracle Corporation’s Oracle Agile PLM product, version 2.6, has been identified as affected. The vulnerability resides in the Acollect component. No other versions or products are listed as impacted.

Risk and Exploitability

The CVSS score of 7.5 indicates a high severity. While the EPSS score is not available, the vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been observed in the wild. The likely attack vector is unauthenticated network access via HTTP; an attacker can exploit the flaw without authentication and without impacting any local system factors. The impact is complete data confidentiality loss for the affected Oracle Agile PLM instance.

Generated by OpenCVE AI on October 21, 2026 at 05:04 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Verify whether Oracle has released a patch or hotfix for Agile PLM 2.6; if available, apply it promptly.
  • Restrict inbound HTTP traffic to the Agile PLM instance using firewall rules or VPN to limit exposure to trusted IP addresses.
  • Implement continuous monitoring of access logs for anomalous activity and review any unauthorized requests.

Generated by OpenCVE AI on October 21, 2026 at 05:04 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 21 Oct 2026 05:30:00 +0000

Type Values Removed Values Added
Title Unauthorized HTTP Access Compromise in Oracle Agile PLM
Weaknesses CWE-200
CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Acollect). The supported version that is affected is 2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Agile PLM accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
First Time appeared Oracle
Oracle agile Plm
CPEs cpe:2.3:a:oracle:agile_plm:2.6:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle agile Plm
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Oracle Agile Plm
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-20T21:21:34.341Z

Reserved: 2026-09-28T15:40:09.492Z

Link: CVE-2026-101562

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-20T22:18:07.953

Modified: 2026-10-20T22:18:07.953

Link: CVE-2026-101562

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-21T05:15:07Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-284

    Improper Access Control