Description
Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Web Client). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Agile PLM accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
Published: 2026-10-20
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Confidentiality Breach
Action: Apply Patch
AI Analysis

Impact

The Oracle Agile PLM Web Client contains a flaw that permits an unauthenticated attacker to send HTTP requests and read a restricted subset of system data. The vulnerability leads to a confidentiality impact only; it does not alter data integrity or disrupt service availability.

Affected Systems

Oracle Agile PLM version 9.3.6 is the only release that is affected by this vulnerability.

Risk and Exploitability

The CVSS v3.1 base score is 5.3, emphasizing a moderate risk to confidentiality. The exploit requires only network access over HTTP and no authentication. No EPSS data is available, and the issue is not listed in the CISA KEV catalog, indicating that it is not a known widely exploited vulnerability at present. The attack vector is likely remote, originating from any external endpoint that can reach the PLM web interface.

Generated by OpenCVE AI on October 21, 2026 at 03:47 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Oracle Agile PLM 9.3.6 patch released in the October 2026 critical patch update to fix the read‑access flaw
  • Restrict outbound network traffic to the Agile PLM Web Client by firewalling or VPN so that only trusted internal or remote users can reach the HTTP endpoint
  • Enforce HTTPS and role‑based authentication for the Web Client to prevent unauthenticated read access
  • Monitor audit logs for unexpected GET requests to the PLM web interface and investigate any suspicious activity

Generated by OpenCVE AI on October 21, 2026 at 03:47 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 21 Oct 2026 04:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Read Access in Oracle Agile PLM 9.3.6
Weaknesses CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Web Client). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Agile PLM accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
First Time appeared Oracle
Oracle agile Plm
CPEs cpe:2.3:a:oracle:agile_plm:9.3.6:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle agile Plm
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Oracle Agile Plm
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-22T15:18:58.598Z

Reserved: 2026-09-28T15:40:09.501Z

Link: CVE-2026-101716

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:18:26.267

Modified: 2026-10-22T16:17:13.863

Link: CVE-2026-101716

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-21T04:00:06Z

Weaknesses