The vulnerability in Oracle Agile PLM's Folders, Files & Attachments component allows a low‑privileged attacker with network access via HTTP to read critical data or all data accessible by the application. The public CVSS vector indicates it is a medium‑severity, purely confidentiality‑impacting flaw, with no integrity or availability consequences. Successful use of the flaw would breach data confidentiality and could expose sensitive supply‑chain information to the attacker.

Oracle Corporation’s Oracle Agile PLM product, specifically version 9.3.6. The only affected release stated is 9.3.6; other releases are not listed as vulnerable in the available data.

The CVSS base score of 6.5 suggests a moderate risk level. An attacker must be on the same network and able to issue HTTP requests, but no advanced privileges are required. The EPSS score is not available, so the exact likelihood of exploitation is unknown, and the vulnerability is not listed in CISA’s KEV catalog. Based on the network‑based attack vector and the potential for confidential data exposure, attention should be given to both user and network‑layer defenses.