A low-privilege attacker who can log on to the infrastructure where Oracle Agile PLM executes can exploit a vulnerability in the product’s security component. Successful exploitation allows the attacker to gain unauthorized access to critical or all accessible data, and to insert, modify, or delete that data, thereby compromising confidentiality and integrity. The vulnerability is rated moderate with a CVSS 3.1 Base Score of 6.4, indicating that a combination of low authenticity and low privileges is sufficient to reach impact. This impact could enable an attacker to alter supply‑chain information, disrupt processes, or facilitate additional attacks on related systems.

The affected vendor is Oracle Corporation and the product is Oracle Agile PLM. The vulnerability exists in version 9.3.6, which is the only version identified as affected. Because the vulnerability is in Oracle Agile PLM, attacks may also impact additional products, though no specific products are listed.

The CVSS score of 6.4 reflects moderate severity; the EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers require only low privileges and local access to the environment hosting Agile PLM, making targeted exploitation feasible but not trivial. The scope change indicates that a successful compromise could extend beyond the initial product to other components or applications on the same infrastructure if not addressed.