A flaw in Oracle Agile PLM 9.3.6 permits an unauthenticated attacker with network access via HTTP to compromise the application and take over the system. The vulnerability can be exploited easily and results in full compromise of confidentiality, integrity and availability.

Oracle Corporation’s Oracle Agile PLM 9.3.6 is affected. No other affected versions are listed.

The CVSS Base Score of 9.8 marks this as a critical vulnerability. The EPSS score is less than 1%, indicating that exploitation may not yet be widespread, and the vulnerability is not in CISA’s KEV catalog. However, the likely attack vector is any network host able to reach the application over HTTP, and the absence of authentication requirements makes it trivial for an attacker to execute the exploit. Successful exploitation could result in full system takeover.