CVE-2026-71045 in Agile PLM
Summary
by MITRE • 08/19/2026
Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Security). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Agile PLM. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/19/2026
The identified vulnerability resides within the Security component of Oracle Agile Product Lifecycle Management version 9.3.6, a critical enterprise solution used for managing product data and supply chain processes. This flaw represents a significant security deficiency that allows an unauthenticated attacker to compromise the integrity and availability of the system through network access via HTTP. The severity of this issue is quantified by a CVSS 3.1 Base Score of 8.8, indicating a High level of risk due to substantial impacts on confidentiality, integrity, and availability. The attack vector is classified as Network with Low complexity, meaning that no specialized conditions or physical proximity are required for exploitation beyond standard network connectivity. However, the presence of User Interaction in the CVSS vector suggests that the exploit mechanism relies on social engineering tactics or requires a victim to perform a specific action, such as clicking a malicious link or opening a crafted document, which serves as a prerequisite for successful compromise.
From a technical perspective, this vulnerability likely stems from insufficient validation or sanitization of user-supplied input within the web application layer of Oracle Agile PLM. While the exact code-level flaw is not detailed in the summary, vulnerabilities with these characteristics often involve Cross-Site Scripting that escalates to remote code execution through browser exploits, or potentially a flawed authentication bypass mechanism where session tokens are manipulated after initial human interaction validates access. The requirement for human interaction implies that the attacker cannot directly inject malicious payloads into server-side logic without first tricking an authorized user into initiating a request that triggers the vulnerable function. This dynamic shifts the attack from a purely automated network intrusion to one requiring targeted social engineering, yet it remains highly dangerous because once triggered, the resulting takeover of Oracle Agile PLM grants the attacker full administrative control over the application environment.
The operational impact of this vulnerability is severe and multifaceted. A successful compromise leads to complete system takeover, allowing the attacker to exfiltrate sensitive product design data, intellectual property, and supply chain information stored within the PLM database. This directly violates confidentiality requirements under standards such as GDPR or HIPAA if applicable data types are present. Furthermore, the integrity impact allows attackers to alter critical manufacturing instructions, bill of materials, or supplier contracts, potentially leading to costly production errors or financial fraud. The availability impact means that an attacker could disrupt business operations by defacing web interfaces, locking out legitimate users, or deploying ransomware within the application context. This aligns with MITRE ATT&CK techniques such as T1078 Valid Accounts if the human interaction leads to credential theft, or T1190 Exploit Public-Facing Application for initial access through HTTP services.
To mitigate this risk, immediate action is required at both the technical and procedural levels. Oracle has likely released a patch or update addressing this specific security flaw in version 9.3.6; organizations must apply these updates immediately to close the vulnerability at its source. In environments where patching cannot be performed instantly due to operational constraints, network-level controls should be implemented. This includes restricting HTTP access to the Agile PLM interface exclusively through secure HTTPS channels and implementing Web Application Firewalls that can detect and block patterns associated with exploitation attempts requiring user interaction. Additionally, security awareness training for employees is crucial to reduce the success rate of social engineering attacks that facilitate this vulnerability's activation. Regular audits of administrative privileges and monitoring for anomalous activity within the PLM system will help in early detection of any attempted or successful compromises resulting from this flaw.