CVE-2026-87258 in Agile PLM
Summary
by MITRE • 09/16/2026
Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Folders, Files & Attachments). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Agile PLM, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Agile PLM accessible data as well as unauthorized update, insert or delete access to some of Oracle Agile PLM accessible data. CVSS 3.1 Base Score 7.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The identified vulnerability resides within the Folders, Files & Attachments component of Oracle Agile Product Lifecycle Management version 9.3.6, a critical system used for managing product data and supply chain information. This security flaw is classified as an easily exploitable issue that allows attackers with low privileges to compromise the integrity and confidentiality of the application environment. The attack vector requires network access via HTTP, indicating that the vulnerability can be triggered remotely over standard web protocols without requiring specialized local access or physical proximity to the target system. While the privilege requirement for the attacker is listed as low, meaning they do not need administrative rights on the underlying operating system or database, the successful exploitation of this flaw leads to a significant escalation in impact due to scope changes affecting additional products beyond just Oracle Agile PLM itself.
The technical nature of this vulnerability involves insufficient validation or access control mechanisms within the file handling subsystems of the application. This allows an authenticated user with minimal privileges to manipulate how files are stored, retrieved, or referenced within the system's folder structure. The requirement for human interaction suggests that the exploit may rely on social engineering tactics, such as tricking a privileged user into clicking a malicious link or opening a specially crafted file attachment that triggers the underlying code flaw. This dependency on user action is a common characteristic of certain types of cross-site scripting or server-side request forgery variants where the initial trigger requires a victim to perform an action within the trusted application context, thereby bypassing some automated security controls.
The operational impact of this vulnerability is severe, primarily affecting data confidentiality and integrity while leaving availability largely intact according to the provided CVSS metrics. Successful exploitation can result in unauthorized access to critical business data stored within Oracle Agile PLM, including sensitive design specifications, supplier information, and manufacturing processes. Furthermore, attackers gain the ability to perform unauthorized updates, inserts, or deletes on accessible data sets. This capability allows for the modification of product records, deletion of essential documentation, or insertion of malicious content that could propagate further into connected systems. The scope change indicates that compromising Oracle Agile PLM through this vector can lead to lateral movement or privilege escalation in adjacent applications within the enterprise architecture, amplifying the potential damage beyond a single software instance.
From an industry standards perspective, this vulnerability aligns with CWE-20 Improper Input Validation and potentially CWE-918 Server-Side Request Forgery if the file handling involves fetching external resources. The requirement for human interaction maps to ATT&CK technique T1566 Phishing, as attackers must deceive a user into initiating the exploit chain. Additionally, the unauthorized access to critical data corresponds to MITRE ATT&CK tactic TA0003 Persistence or TA0007 Discovery depending on whether the attacker is maintaining foothold or gathering intelligence. The low privilege requirement combined with high impact highlights a classic authorization bypass scenario where role-based access controls are not strictly enforced during file operations, allowing lower-level users to perform actions reserved for higher-privileged roles.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. Oracle should be contacted immediately to apply the latest security patches or updates that address this specific flaw in version 9.3.6. In the absence of an official patch, organizations should implement strict input validation rules for all file upload and download endpoints within Agile PLM. Network segmentation can help limit the blast radius by isolating Oracle Agile PLM servers from general corporate networks, ensuring that even if a user is compromised via phishing, lateral movement to other critical systems is restricted. Additionally, enforcing multi-factor authentication for all users with access to sensitive modules reduces the risk of credential theft leading to exploitation. Security awareness training should be conducted to educate employees on recognizing suspicious links and attachments, directly addressing the human interaction requirement of this vulnerability. Regular audits of user permissions ensure that low-privileged accounts do not have excessive rights over file management functions, adhering to the principle of least privilege.