Description
Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Security). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Agile PLM. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
Published: 2026-08-18
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is an authentication failure flaw in the Security component of Oracle Agile PLM 9.3.6 that allows an unauthenticated attacker with network access over HTTP to potentially compromise the application. Successful exploitation requires human interaction from a user other than the attacker, after which the attacker can gain full control of the system, reading, modifying, or deleting data and disrupting availability.

Affected Systems

Oracle Agile PLM 9.3.6, supplied by Oracle Corporation and part of its Oracle Supply Chain solutions. The CVE specifically targets the Security component of this version; no other releases are listed as vulnerable.

Risk and Exploitability

The CVSS 3.1 base score of 8.8 indicates a high‑severity issue, with network access, low complexity, no privileges, and user interaction required. The EPSS score is below 1 % and the vulnerability is not in the CISA KEV catalog, suggesting a low probability of widespread exploitation. However, because the flaw can lead to full takeover of Oracle Agile PLM once user interaction occurs, organizations exposing Agile PLM to the public network face a significant risk and should act promptly.

Generated by OpenCVE AI on August 20, 2026 at 23:02 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Oracle security update that fixes the vulnerable version 9.3.6 of Agile PLM.
  • Restrict external HTTP access to the Agile PLM instance using firewall rules, VPN, or IP whitelisting.
  • Monitor and review HTTP access logs for suspicious activity, and block traffic patterns indicative of exploitation attempts.

Generated by OpenCVE AI on August 20, 2026 at 23:02 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 25 Aug 2026 16:45:00 +0000

Type Values Removed Values Added
First Time appeared Oracle agile Product Lifecycle Management
CPEs cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.6:*:*:*:*:*:*:*
Vendors & Products Oracle agile Product Lifecycle Management

Thu, 20 Aug 2026 23:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Access Enables Full Takeover of Oracle Agile PLM 9.3.6

Thu, 20 Aug 2026 07:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Authorization Flaw Enables Takeover of Oracle Agile PLM 9.3.6

Wed, 19 Aug 2026 22:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Authorization Flaw Enables Takeover of Oracle Agile PLM 9.3.6

Wed, 19 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284

Wed, 19 Aug 2026 15:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote Takeover via HTTP in Oracle Agile PLM 9.3.6
Weaknesses CWE-287

Wed, 19 Aug 2026 10:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote Takeover via HTTP in Oracle Agile PLM 9.3.6
Weaknesses CWE-287

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Security). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Agile PLM. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle agile Plm
CPEs cpe:2.3:a:oracle:agile_plm:9.3.6:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle agile Plm
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Agile Plm Agile Product Lifecycle Management
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-19T16:05:00.896Z

Reserved: 2026-08-04T22:06:34.613Z

Link: CVE-2026-71045

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Analyzed

Published: 2026-08-18T21:18:04.373

Modified: 2026-08-25T16:27:12.847

Link: CVE-2026-71045

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-20T23:15:05Z

Weaknesses