Description
Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Export). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks of this vulnerability can result in takeover of Oracle Agile PLM. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-08-18
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Oracle Agile PLM version 9.3.6 contains a flaw in the Export component that lets a low‑privileged attacker reach the system over HTTP. Employing this vulnerability may grant the attacker full control of the application, jeopardizing confidentiality, integrity and availability. The weakness is classified as CWE‑284, representing an improper access control error.

Affected Systems

The affected product is Oracle Agile PLM, version 9.3.6, delivered through the Export component.

Risk and Exploitability

With an AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H vector the flaw is easily exploitable from the network, requiring only low privilege to achieve a complete takeover. The EPSS score of < 1% indicates a low probability of exploit, yet the high CVSS 3.1 base score of 8.8 signals severe potential impact. The vulnerability is not listed in CISA KEV.

Generated by OpenCVE AI on August 20, 2026 at 23:02 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Oracle security patch that addresses the Export component in Agile PLM 9.3.6, or upgrade to a later version that includes the fix
  • Restrict HTTP access to Agile PLM only to trusted IP ranges or enforce strong network segmentation to limit the attack surface
  • If a patch is unavailable, disable the Export component or block its endpoints until remediation is applied

Generated by OpenCVE AI on August 20, 2026 at 23:02 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 25 Aug 2026 16:45:00 +0000

Type Values Removed Values Added
First Time appeared Oracle agile Product Lifecycle Management
CPEs cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.6:*:*:*:*:*:*:*
Vendors & Products Oracle agile Product Lifecycle Management

Thu, 20 Aug 2026 23:30:00 +0000

Type Values Removed Values Added
Title Improper Access Control Enables Low-Privilege Takeover of Oracle Agile PLM Export Component

Thu, 20 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 19 Aug 2026 22:15:00 +0000

Type Values Removed Values Added
Title Low‑Privilege HTTP Takeover in Oracle Agile PLM 9.3.6 Export Component

Wed, 19 Aug 2026 08:15:00 +0000

Type Values Removed Values Added
Title Low‑Privilege HTTP Takeover in Oracle Agile PLM 9.3.6 Export Component
Weaknesses CWE-284

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Export). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks of this vulnerability can result in takeover of Oracle Agile PLM. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle agile Plm
CPEs cpe:2.3:a:oracle:agile_plm:9.3.6:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle agile Plm
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Agile Plm Agile Product Lifecycle Management
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-19T16:05:14.176Z

Reserved: 2026-08-04T22:06:34.613Z

Link: CVE-2026-71044

cve-icon Vulnrichment

Updated: 2026-08-19T15:48:00.975Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-18T21:18:04.257

Modified: 2026-08-25T16:27:15.543

Link: CVE-2026-71044

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-20T23:15:05Z

Weaknesses