The vulnerability is located in the Oracle Agile PLM application server of version 9.3.6. A low‑privileged attacker that can reach the application over HTTP can exploit a flaw that permits unauthorized create, update, delete, or read access to data the attacker should not see. The weakness violates proper access controls, resulting in confidentiality and integrity damage for data that falls under the affected system's responsibilities.

Oracle Agile PLM version 9.3.6, supplied by Oracle Corporation, component Application Server. The vulnerability is documented in Oracle's October 2026 CPU advisory.

The CVSS 3.1 base score of 5.4 indicates moderate severity. The risk is elevated because the flaw requires only low privileges but still provides a path to modify or read protected data and may affect other Oracle products due to scope change. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers need network access via HTTP and a second user to interact because the attack vector requires user interaction, so the exploitation probability is moderate but plausible within a hostile network.