CVE-2026-87252: Medium severity Oracle Oracle Agile PLM vulnerability

Published Sep 15, 2026

Updated

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Application Server). The supported version that is affected is 9.3.6. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle Agile PLM executes to compromise Oracle Agile PLM. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Agile PLM accessible data as well as unauthorized access to critical data or complete access to all Oracle Agile PLM accessible data. CVSS 3.1 Base Score 6.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).

Affected Software

2 affected components

Oracle Oracle Agile PLM=9.3.6

Oracle Agile Product Lifecycle Management=9.3.6

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Compensating control
Restrict network access to the physical communication segment (where Oracle Agile PLM Application Server is connected) to trusted systems only, since exploitation requires access to the physical communication segment attached to the hardware running Oracle Agile PLM.

Event History

Sep 15, 2026

CVE Published

via MITRE·08:06 PM

Data Sourced

via MITRE·08:06 PM

DescriptionSeverity

Data Sourced

via NVD·08:19 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

Who is realistically exposed to this issue?

Exposure is limited to Oracle Agile PLM Application Server deployments running the affected supported version, 9.3.6, where an attacker can access the physical communication segment attached to the hardware hosting the product.

Does an attacker need an Oracle Agile PLM account or user interaction?

No. The vulnerability can be exploited by an unauthenticated attacker and does not require user interaction, but exploitation is described as difficult and requires adjacent-network access.

What could a successful attacker do?

A successful attack could allow unauthorized access to critical data or all data accessible through Oracle Agile PLM. It could also allow creation, deletion, or modification of critical data or all Oracle Agile PLM-accessible data.