Oracle Agile PLM includes a component named Acollect that contains an authentication bypass flaw. An attacker who can reach the service over TLS can connect without credentials and gain unauthorized read access to sensitive data. The flaw mainly impacts confidentiality, leaving integrity and availability untouched, and is identified by a CVSS 3.1 base score of 5.9.

Oracle Corporation’s Agile PLM version 2.6 is affected. The flaw resides in the Acollect component of the Oracle Supply Chain product line.

The moderate CVSS score combined with a high attack complexity value indicates that the vulnerability is not trivial to exploit. Because the attacker must have network visibility to the TLS endpoint, a public or broadly available exploitation surface is limited. EPSS data is not available, the vulnerability is not listed in CISA KEV, and no active exploits are reported, so the immediate risk is low to moderate but warrants timely remediation.