A vulnerability in the Import component of Oracle Agile PLM permits an attacker who has logon access to the underlying infrastructure to compromise the application. Because no authentication is required, the attacker can read confidential data exposed through the PLM system. The vulnerability is classified as a local attack with low effort and no user interaction, and its primary impact is on confidentiality, with no effect on integrity or availability.

The affected product is Oracle Agile PLM, version 9.3.6. The vulnerability is present in the Import module of this product; the CVE description does not state that other versions or components are affected.

The CVSS score of 6.2 indicates a medium severity risk. The attack vector is local and requires the attacker to have logon to the host running Agile PLM, but no additional privileges are needed. Because the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, the likelihood of a real-world exploit has not been quantified, yet the local nature and lack of privilege elevation make it potentially exploitable in environments where infrastructure access is not tightly controlled.