Description
Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Application Server). The supported version that is affected is 9.3.6. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Agile PLM. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).
Published: 2026-10-20
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Full System Compromise
Action: Assess Impact
AI Analysis

Impact

A vulnerability exists in the Oracle Agile PLM product of Oracle Supply Chain, specifically the application server component of version 9.3.6. The flaw permits an unauthenticated attacker who can reach the service over HTTP to influence the application in a way that can eventually lead to a takeover of the entire system. In order to successfully exploit the vulnerability, an attacker still needs an additional human interaction by a user other than themselves. The successful exploitation would compromise confidentiality, integrity, and availability of the Oracle Agile PLM installation.

Affected Systems

The affected product is Oracle Agile PLM version 9.3.6, as documented in Oracle’s October 2026 security alert. Administrators of Oracle Supply Chain environments running this version should verify that the application server component is deployed and is using the affected version.

Risk and Exploitability

The CVSS v3.1 base score of 7.5 reflects high severity, with impacts to confidentiality, integrity and availability. The exploit requires network access over HTTP, no privileged authentication, but still needs human interaction to complete the attack chain. EPSS data is not available for this vulnerability, and it is not listed in the CISA KEV catalog. Because the flaw can lead to a full takeover of Oracle Agile PLM, the risk remains significant even without known exploits.

Generated by OpenCVE AI on October 21, 2026 at 05:16 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Restrict external HTTP access to the application server by enforcing firewall rules or VPN‑only connections, limiting public exposure.
  • Disable or restrict any unused administrative interfaces or features that may be exploitable, and enforce strict authentication and role‑based access control for all enabled interfaces.
  • Monitor for suspicious activity and review Oracle’s October 2026 security alert for any new fixes or updates; apply them when available.

Generated by OpenCVE AI on October 21, 2026 at 05:16 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 21 Oct 2026 05:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
CWE-862

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Application Server). The supported version that is affected is 9.3.6. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Agile PLM. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle agile Plm
CPEs cpe:2.3:a:oracle:agile_plm:9.3.6:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle agile Plm
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Agile Plm
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-22T15:18:51.629Z

Reserved: 2026-09-28T15:40:09.502Z

Link: CVE-2026-101719

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:18:26.617

Modified: 2026-10-22T16:17:14.090

Link: CVE-2026-101719

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-21T05:30:13Z

Weaknesses