Oracle Agile PLM version 9.3.6 contains a flaw that allows an unauthenticated attacker with network access via TLS to compromise the system. The attacker does not need valid credentials; by exploiting the vulnerability the attacker can read critical data and perform unauthorized updates, inserts, or deletes to all data accessible within the application. The weakness is reflected in the CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N), showing moderate confidentiality loss and low integrity impact but no availability effect. In practical terms, the flaw permits the attacker to compromise the confidentiality of sensitive supply‑chain information and to alter data in ways that could disrupt business operations.

Oracle Corporation’s Oracle Agile PLM product, version 9.3.6.

The CVSS score of 6.5 indicates a moderate level of risk. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been widely exploited in the wild. The attack requires only network connectivity to the application server over an encrypted TLS channel and does not need privileged credentials. Once the attacker succeeds, full access to all data stored in Agile PLM is possible, making the vulnerability potentially impactful for confidentiality and data integrity.