Description
Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: PGC / Excel Plugin). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Agile PLM accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Agile PLM. CVSS 3.1 Base Score 8.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H).
Published: 2026-08-18
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Oracle Agile PLM version 9.3.6 contains a flaw in its PGC/Excel Plugin that enables a low‑privileged network attacker to create, delete, or modify critical data without requiring user interaction. Successful exploitation can also cause the application to hang or repeatedly crash, resulting in a complete denial of service. The weakness is identified as a CWE‑284 (Improper Access Control).

Affected Systems

Oracle Agile PLM 9.3.6, specifically the PGC/Excel Plugin component, is the affected product. No other versions or components are known to contain this issue.

Risk and Exploitability

The vulnerability carries a CVSS base score of 8.1, indicating high severity with significant integrity and availability impacts. The EPSS score is less than 1%, hinting at a low but nonzero exploitation probability. Though not listed in the CISA KEV catalog, the lack of a KEV status does not mitigate the risk, especially given the critical supply‑chain data handled by Oracle Agile PLM. Attackers can exploit the flaw through network‑based HTTP requests from any remote location, requiring only low privileges and no user interaction.

Generated by OpenCVE AI on August 20, 2026 at 19:32 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to a version of Oracle Agile PLM that includes the patch for the Excel Plugin vulnerability
  • If upgrading is infeasible, disable the Excel Plugin and restrict external HTTP access to limit exposure
  • Apply any vendor‑issued security patches for the Excel Plugin as soon as they become available

Generated by OpenCVE AI on August 20, 2026 at 19:32 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 25 Aug 2026 16:45:00 +0000

Type Values Removed Values Added
First Time appeared Oracle agile Product Lifecycle Management
CPEs cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.6:*:*:*:*:*:*:*
Vendors & Products Oracle agile Product Lifecycle Management

Thu, 20 Aug 2026 20:00:00 +0000

Type Values Removed Values Added
Title Low‑Privileged HTTP Access Allows Unauthorized Data Modification and Denial of Service in Oracle Agile PLM

Thu, 20 Aug 2026 08:45:00 +0000

Type Values Removed Values Added
Title Low‑Privileged HTTP Access Allows Unauthorized Data Modification and Denial of Service in Oracle Agile PLM

Thu, 20 Aug 2026 02:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 19 Aug 2026 21:45:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Modification and Denial of Service via Excel Plugin in Oracle Agile PLM 9.3.6

Wed, 19 Aug 2026 09:15:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Modification and Denial of Service via Excel Plugin in Oracle Agile PLM 9.3.6
Weaknesses CWE-284

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: PGC / Excel Plugin). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Agile PLM accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Agile PLM. CVSS 3.1 Base Score 8.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H).
First Time appeared Oracle
Oracle agile Plm
CPEs cpe:2.3:a:oracle:agile_plm:9.3.6:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle agile Plm
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H'}

Subscriptions

Oracle Agile Plm Agile Product Lifecycle Management
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-19T16:05:29.380Z

Reserved: 2026-08-04T22:06:34.613Z

Link: CVE-2026-71042

cve-icon Vulnrichment

Updated: 2026-08-19T15:42:42.938Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-18T21:18:03.990

Modified: 2026-08-25T16:27:19.460

Link: CVE-2026-71042

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-20T19:45:03Z

Weaknesses