Description
Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Acollect). The supported version that is affected is 2.6. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Agile PLM. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Agile PLM accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).
Published: 2026-10-20
Score: 5.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized data access through unauthenticated TLS connections
Action: Patch
AI Analysis

Impact

A vulnerability in the Acollect component of Oracle Agile PLM version 2.6 permits an attacker with network connectivity to the TLS endpoint to authenticate without credentials and retrieve critical data, resulting in a confidentiality breach. The flaw is categorized as CWE-200 and carries a CVSS 3.1 base score of 5.9, indicating that data confidentiality is the principal impact while integrity and availability remain unaffected.

Affected Systems

Oracle Agile PLM version 2.6 is the affected product. The specific vulnerability is located in the Acollect component of the Oracle Supply Chain suite.

Risk and Exploitability

The moderate CVSS score combined with a high attack complexity suggests that exploitation requires deliberate effort. Network access to the TLS service is a prerequisite, limiting the attack surface to reachable servers. The EPSS score of < 1% and the absence from the CISA KEV catalog imply a low likelihood of current exploitation, yet the confidentiality risk warrants prompt remediation.

Generated by OpenCVE AI on November 7, 2026 at 01:53 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the official Oracle patch released in the CPU October 2026 advisory
  • Restrict inbound TLS traffic to the Agile PLM server with firewall rules or network segmentation to limit exposure to trusted sources
  • Disable or reconfigure the Acollect component if it is not required for your environment to reduce the attack surface

Generated by OpenCVE AI on November 7, 2026 at 01:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 07 Nov 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sat, 07 Nov 2026 02:15:00 +0000

Type Values Removed Values Added
Title Oracle Agile PLM 2.6 Unauthenticated Data Access via TLS

Sat, 07 Nov 2026 00:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated TLS Remote Access to Oracle Agile PLM 2.6
Weaknesses CWE-284

Fri, 06 Nov 2026 22:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200

Wed, 21 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated TLS Remote Access to Oracle Agile PLM 2.6
Weaknesses CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Acollect). The supported version that is affected is 2.6. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Agile PLM. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Agile PLM accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).
First Time appeared Oracle
Oracle agile Plm
CPEs cpe:2.3:a:oracle:agile_plm:2.6:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle agile Plm
References
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Oracle Agile Plm
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-11-06T21:28:37.819Z

Reserved: 2026-09-28T15:40:09.492Z

Link: CVE-2026-101564

cve-icon Vulnrichment

Updated: 2026-11-06T21:28:09.907Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:18:08.123

Modified: 2026-11-06T22:17:48.857

Link: CVE-2026-101564

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-07T02:00:08Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor