CVE-2026-101565: Infoleak
Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Import). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Agile PLM executes to compromise Oracle Agile PLM. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Agile PLM accessible data. CVSS 3.1 Base Score 6.2 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Oracle Agile PLM deployments running the supported affected version 9.3.6 are exposed when an attacker can log on to the infrastructure where Agile PLM executes. The attack vector is local, so it is not described as remotely exploitable over the network alone.
What access does an attacker need to exploit it?
The attacker does not need Agile PLM credentials or other application privileges, but must have logon access to the underlying infrastructure hosting Oracle Agile PLM. No user interaction is required.
What is the potential impact of successful exploitation?
Successful exploitation can allow unauthorized access to critical data, potentially including all data accessible to Oracle Agile PLM. The stated impact is confidentiality only; integrity and availability impacts are not listed.