CVE-2026-101565 in Agile PLM
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Import). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Agile PLM executes to compromise Oracle Agile PLM. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Agile PLM accessible data. CVSS 3.1 Base Score 6.2 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Import component of Oracle Agile Product Lifecycle Management, specifically affecting version 9.3.6 which is part of the broader Oracle Supply Chain suite. This software solution is widely utilized by enterprises for managing product data and lifecycle processes across complex supply chains. The flaw represents a significant security gap that allows an attacker to bypass standard authentication mechanisms required for accessing sensitive enterprise resources. While the vulnerability requires the attacker to have logon access to the infrastructure where Oracle Agile PLM executes, this prerequisite does not necessitate valid user credentials within the application itself, thereby classifying it as an unauthenticated attack vector relative to the target system's internal security controls. This distinction is critical because it lowers the barrier for exploitation compared to vulnerabilities that require prior authenticated sessions or complex social engineering tactics.
From a technical perspective, the core issue lies in how the Import functionality processes data without enforcing adequate access control checks during specific operations. The vulnerability enables unauthorized actors to manipulate import routines to extract sensitive information from the database backend. Because the flaw allows for complete access to all Oracle Agile PLM accessible data, it effectively compromises the confidentiality integrity of the entire system's repository. This includes proprietary product designs, supplier contracts, cost structures, and other critical business intelligence that is central to the organization's competitive advantage. The absence of proper validation or authorization checks within this specific module means that any entity with network-level access to the server hosting the application can potentially trigger these import functions to exfiltrate data without triggering standard audit logs associated with legitimate user logins.
The operational impact of exploiting this vulnerability is severe, primarily due to the high confidentiality impact indicated by a CVSS 3.1 Base Score of 6.2. Although the vector indicates local network access (AV:L) and low complexity (AC:L), the ability to gain complete read-access to all data transforms what might otherwise be an informational disclosure into a critical business risk. Competitors could leverage stolen product roadmaps or manufacturing processes, leading to direct financial loss and erosion of market position. Furthermore, in regulated industries such as aerospace, automotive, or medical devices, unauthorized access to design specifications can lead to compliance violations with standards like ISO 9001 or ITAR regulations. The lack of impact on integrity (I:N) and availability (A:N) suggests that the primary threat is data theft rather than system disruption, but the value of stolen intellectual property often outweighs temporary service outages in terms of long-term organizational harm.
In alignment with industry-standard classification frameworks, this vulnerability maps closely to CWE-284 Improper Access Control, as it involves a failure to restrict access to resources for unauthorized actors. Additionally, given that exploitation requires network proximity but not prior authentication within the application, it aligns with ATT&CK technique T1078 Valid Accounts if the attacker uses compromised infrastructure credentials, or potentially T1530 Data from Cloud Storage if viewed through the lens of exfiltrating data stored in backend systems. The vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N confirms that while physical or local network access is needed, no user interaction or prior privileges are required to achieve high confidentiality impact. This profile highlights the danger of assuming infrastructure-level security provides sufficient application-layer protection.
Mitigation strategies must focus on immediate isolation and patching. Organizations running Oracle Agile PLM version 9.3.6 should apply the latest available patches provided by Oracle, which typically address these access control flaws in subsequent maintenance releases or interim fixes. Until patches are applied, network segmentation is a critical compensating control; administrators should restrict direct server-to-server communication to only those IP addresses that absolutely require it for legitimate business functions. Implementing strict firewall rules to limit inbound traffic on the ports used by Oracle Agile PLM can significantly reduce the attack surface. Additionally, enabling comprehensive logging and monitoring for import-related API calls or database queries can help detect anomalous activity indicative of exploitation attempts. Regular vulnerability assessments focused specifically on supply chain management tools are recommended to ensure that such gaps do not persist in production environments where sensitive intellectual property is housed.