CVE-2026-101718: Medium severity Oracle Agile PLM vulnerability
Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Application Server). The supported version that is affected is 9.3.6. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Agile PLM. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Agile PLM accessible data as well as unauthorized update, insert or delete access to some of Oracle Agile PLM accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N).
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this vulnerability?
Oracle Agile PLM Application Server deployments running the supported affected version 9.3.6 are exposed if they are reachable by an attacker over the network via TLS.
Does exploitation require an authenticated account or user interaction?
No. The vulnerability can be exploited by an unauthenticated attacker, and no user interaction is required. Exploitation is described as difficult, reflected by the high attack complexity rating.
What could a successful attacker do?
A successful attack can provide unauthorized access to critical data or complete access to Oracle Agile PLM-accessible data. It can also allow unauthorized update, insert, or delete operations on some accessible data.