CVE-2026-101562: Infoleak
Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Acollect). The supported version that is affected is 2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Agile PLM accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An unauthenticated attacker with network access to the affected Acollect component over HTTP can exploit it. No credentials or user interaction are required.
What is the potential impact of a successful attack?
A successful attack can give an attacker unauthorized access to critical data or complete access to all data accessible through Oracle Agile PLM. The documented impact is confidentiality only; integrity and availability impacts are not indicated.
Which deployments are known to be affected?
The affected component is Acollect in Oracle Agile PLM, and version 2.6 is identified as affected. The provided information does not state whether any particular default configuration or exposure pattern is required beyond HTTP network access.