Oracle Agile PLM includes a component that fails to enforce adequate access controls, allowing any network user to discover and read sensitive data via HTTP. According to the CVE description, the vulnerability lies in the User and User Group handling and has a CVSS 3.1 base score of 7.5, indicating moderate to high severity for confidentiality. An attacker can read any data the system makes available without authentication, leading to possible leaks of confidential information.

Oracle Corporation’s Agile PLM product, specifically version 9.3.6, is affected. The Supply Chain Products Suite version 9.3.4 also contains the vulnerable component, but the advisory explicitly references 9.3.6 for the main impact.

The CVSS score is 7.5, and the EPSS score is reported as less than 1%, implying a very low but non‑zero probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog, suggesting no publicly known exploit either. The attack vector is inferred to be network‑based, accessible over HTTP, and requires no user interaction or authentication. An unauthenticated attacker can reach the vulnerable endpoint and retrieve data, thereby compromising confidentiality of the stored information.