An unauthenticated vulnerability exists in the Oracle Agile PLM web client component of version 9.3.6. It permits a network attacker to initiate HTTP requests that can result in unauthorized update, insert or delete operations on data that the attacker otherwise could not access, as well as read of a restricted subset of data. The weakness is an improper access control that allows functions to be executed without proper authentication or authorization, resulting in confidentiality and integrity impacts as reflected by the CVSS 6.1 score. The exploit requires the attacker to first persuade or trick a different user to interact with the vulnerable endpoint; no exploit is possible without that human interaction step.

Oracle Agile PLM 9.3.6, the problematic Web Client component in this release. The vulnerability is listed only for this version, but the description notes that attacks may also affect other Oracle Supply Chain products by extending the scope.

The CVSS base score of 6.1 indicates a moderate severity threat. The EPSS score is currently not available, and the vulnerability is not yet in the CISA KEV catalog. The likely attack path involves an unauthenticated HTTP request to the web client, followed by a request chain that bypasses normal authorization checks. Because the flaw manifests only after a different user interacts with the system, the absolute probability of exploitation is lower than a true remote code execution, yet organizations with exposed web interfaces remain at increased risk of data tampering or unintended data exposure.