The vulnerability resides in the Application Server component of Oracle Agile PLM. An attacker who can reach the system over HTTP can exploit this flaw without authentication. Successful exploitation leads to reading confidential data, or in some cases, inserting, updating, or deleting data that is normally protected. The impact is primarily on confidentiality and integrity; availability is not directly affected by the described weakness.

Oracle Corporation’s Oracle Agile PLM product, specifically version 9.3.6, is affected. The defect is tied to the application server functionality that processes HTTP requests.

The CVSS 3.1 score of 6.5 classifies this as a moderate severity vulnerability. The attack vector is network based, requiring public HTTP access but no additional privileges or user interaction, making it relatively straightforward for an unauthenticated attacker. The EPSS score is not available, and the vulnerability is not catalogued in CISA’s KEV list. Given the attack path and the potential for unauthorized data payload manipulation, the risk to systems that expose the Agile PLM application server should be considered significant.