CVE-2026-46859: Critical severity Oracle Agile PLM vulnerability
Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Security). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks of this vulnerability can result in takeover of Oracle Agile PLM. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable or block HTTP access to Oracle Agile PLM or restrict it to trusted IP address ranges/internal management network; ensure the application is not directly accessible from the public Internet.
Oracle Agile PLM HTTP access = disabled or restricted to trusted IPs - Compensating control
Restrict network access to Oracle Agile PLM (affected: 9.3.6) at the perimeter and internal firewalls/ACLs so only trusted management hosts or VPN-connected users can reach the service; remove public Internet exposure.
- Compensating control
Deploy a Web Application Firewall (WAF) in front of Oracle Agile PLM to inspect and block malicious HTTP requests and reduce risk from unauthenticated HTTP-based attacks.
- Operational
Monitor HTTP access logs, IDS/IPS and WAF alerts for signs of exploitation against Oracle Agile PLM (9.3.6); investigate and perform incident response (including isolation) if suspicious activity is found.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46859?
CVE-2026-46859 has a critical severity rating of 9.8.
How do I fix CVE-2026-46859?
To fix CVE-2026-46859, upgrade Oracle Agile PLM to the latest version that addresses this vulnerability.
What products are affected by CVE-2026-46859?
CVE-2026-46859 affects the Oracle Agile PLM product, specifically version 9.3.6.
Who can exploit CVE-2026-46859?
CVE-2026-46859 can be exploited by unauthenticated attackers with network access via HTTP.
What impact can CVE-2026-46859 have on an organization?
Successful exploitation of CVE-2026-46859 can lead to a complete compromise of Oracle Agile PLM, affecting confidentiality, integrity, and availability.