CVE-2026-87253 in Agile PLM
Summary
by MITRE • 09/16/2026
Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Web Client). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Agile PLM, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Agile PLM accessible data as well as unauthorized read access to a subset of Oracle Agile PLM accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The identified vulnerability resides within the Web Client component of Oracle Agile Product Lifecycle Management, specifically affecting version 9.3.6 which is part of the broader Oracle Supply Chain suite. This security flaw represents a significant risk to organizations relying on this platform for managing product data and supply chain operations. The core technical issue allows an unauthenticated attacker with network access via HTTP to compromise the integrity and confidentiality of the system. Unlike many vulnerabilities that require complex exploitation chains or specific user privileges, this defect is characterized by its ease of exploitability, meaning that even attackers with limited technical sophistication can leverage it effectively against vulnerable instances.
A critical aspect of this vulnerability is the requirement for human interaction from a person other than the attacker to facilitate successful exploitation. This characteristic aligns closely with social engineering vectors often categorized under CWE-79 or related cross-site scripting paradigms where user action triggers malicious code execution. The necessity for victim interaction suggests that the attack vector likely involves tricking an authorized user into performing an action, such as clicking a crafted link or interacting with a manipulated interface element within the Web Client. This dependency on human behavior significantly influences the risk profile and mitigation strategies required to address the flaw effectively.
The operational impact of this vulnerability is substantial due to its scope change capability. While the technical flaw exists specifically in Oracle Agile PLM, successful exploitation can lead to impacts that extend beyond the immediate application boundary. The attacker gains unauthorized read access to a subset of accessible data as well as the ability to perform unauthorized updates, inserts, or deletes on other portions of the database. This dual impact on both confidentiality and integrity means that sensitive product design information, supplier details, or manufacturing specifications could be exfiltrated or altered without detection. Such tampering can disrupt supply chain continuity, lead to financial loss through incorrect orders or inventory management errors, and compromise intellectual property rights associated with the products managed by the system.
From a classification perspective, this vulnerability maps to CWE-20 Improper Input Validation if the root cause involves insufficient sanitization of user-supplied data within the Web Client interface. It also relates to CWE-79 Cross-site Scripting if the mechanism relies on injecting malicious scripts that execute in the context of an authenticated session triggered by a victim's action. In terms of offensive security frameworks, this aligns with MITRE ATT&CK techniques involving Social Engineering for Credential Access or Initial Compromise, specifically Tactic TA0001 Initial Access and potentially TA0005 Defense Evasion if persistence mechanisms are established through the data manipulation capabilities. The CVSS 3.1 base score of 6.1 reflects a medium severity level, driven by the network-based attack vector, low complexity, lack of required privileges for the initial exploit, but mitigated slightly by the requirement for user interaction and limited availability impact.
Mitigation strategies must address both the technical flaw and the human element involved in its exploitation. Immediate remediation should involve applying the latest security patches provided by Oracle to update the Web Client component beyond version 9.3.6 or apply specific hotfixes if available for this legacy version. Organizations should also implement strict input validation controls on all web-facing interfaces to prevent injection-based attacks. Furthermore, since human interaction is a prerequisite for exploitation, robust user awareness training programs are essential to educate employees about recognizing suspicious links and interactions within the PLM environment. Network-level defenses such as Web Application Firewalls can provide an additional layer of protection by filtering out malicious payloads before they reach the application logic. Regular audits of access logs should be conducted to detect any anomalous activities indicative of attempted exploitation, ensuring that potential breaches are identified and contained promptly.