CVE-2026-101714 in Agile PLM
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Web Client). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Agile PLM, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Agile PLM accessible data as well as unauthorized read access to a subset of Oracle Agile PLM accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Web Client component of Oracle Agile Product Lifecycle Management, specifically affecting version 9.3.6 which is part of the broader Oracle Supply Chain suite. This security flaw represents a significant risk to organizations relying on this platform for managing product data and supply chain processes. The core technical issue allows an unauthenticated attacker with network access via HTTP to compromise the integrity and confidentiality of the system. Unlike many vulnerabilities that require complex exploitation chains or specific user privileges, this defect is easily exploitable due to its low attack complexity. However, it does necessitate human interaction from a victim other than the initial attacker, indicating that social engineering tactics such as phishing are likely required to trigger the malicious code execution within the web client environment.
From an operational perspective, the impact of this vulnerability extends beyond the immediate application layer. While the flaw is technically located in Oracle Agile PLM, successful exploitation can lead to a scope change where additional products or integrated systems are significantly impacted. This lateral movement capability suggests that the compromised state may allow attackers to pivot into adjacent network segments or dependent applications connected to the supply chain infrastructure. The primary consequences involve unauthorized modifications and access to sensitive data stored within the Oracle Agile PLM database. Specifically, an attacker can achieve unauthorized update, insert, or delete operations on accessible data, thereby compromising data integrity. Simultaneously, they gain unauthorized read access to a subset of this data, leading to confidentiality breaches that could expose proprietary product designs, supplier information, or pricing structures critical to business continuity and competitive advantage.
The severity of this vulnerability is quantified by a CVSS 3.1 Base Score of 6.1, which classifies it as Medium risk. The vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) highlights several critical attributes that define the exploitability and impact profile. The Attack Vector is Network, meaning remote exploitation over a network connection such as HTTP is possible without physical access to the target system. The Attack Complexity is Low, indicating that specialized conditions or difficult-to-execute steps are not required for successful exploitation. Crucially, Privileges Required is None, confirming that no prior authentication is needed to initiate the attack sequence. However, User Interaction is marked as Required, which serves as a partial mitigation factor by necessitating victim participation. The Scope is Changed, meaning the vulnerability affects resources beyond the vulnerable component itself, amplifying the potential blast radius of an incident. Both Confidentiality and Integrity impacts are rated as Low, reflecting that while data exposure and modification occur, they may be limited to specific subsets rather than total system compromise.
In terms of industry standard classification, this vulnerability aligns with CWE-79 for Improper Neutralization of Input During Web Page Generation which commonly leads to Cross-Site Scripting or similar injection flaws requiring user interaction. It also maps to MITRE ATT&CK techniques related to Initial Access via Spearphishing Link and potentially Persistence if the injected code establishes a foothold within the client session. The requirement for human interaction places this firmly in the realm of social engineering-driven attacks, where threat actors manipulate users into clicking malicious links or visiting compromised web pages that trigger the exploit against their browser-based interaction with Oracle Agile PLM.
To mitigate these risks, organizations must implement immediate compensating controls while awaiting official patches from Oracle. Network segmentation should be enforced to restrict HTTP access to the Web Client component only from trusted IP ranges and user groups. Implementing a Web Application Firewall can help detect and block malicious payloads associated with this vulnerability by inspecting incoming HTTP requests for known exploit patterns or anomalous behavior indicative of injection attacks. Additionally, rigorous security awareness training is essential to reduce the likelihood of successful human interaction exploitation; employees should be educated on recognizing suspicious links and verifying the authenticity of web content before interacting with it. Regular monitoring of system logs for unusual data access patterns or unauthorized modifications can aid in early detection of attempted exploits. Finally, ensuring that all Oracle Agile PLM instances are updated to the latest supported version as soon as security updates become available is critical to permanently resolving this technical flaw and restoring a secure operational posture.