CVE-2026-87266 in Agile PLM
Summary
by MITRE • 09/16/2026
Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Application Server). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Agile PLM accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Agile PLM. CVSS 3.1 Base Score 8.2 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/16/2026
The identified vulnerability resides within the Application Server component of Oracle Agile PLM, specifically affecting version 9.3.6 which is part of the broader Oracle Supply Chain management suite. This security flaw represents a significant risk to organizations relying on this platform for product lifecycle data and supply chain coordination. The core issue stems from an architectural or implementation deficiency that permits unauthenticated actors to interact with critical server functions over standard HTTP protocols. Because the vulnerability does not require any form of authentication, it eliminates one of the primary layers of defense typically employed in enterprise environments. An attacker located on a network path capable of reaching the Oracle Agile PLM application server can initiate exploitation without needing valid user credentials or prior access to the system. This characteristic aligns with Common Weakness Enumeration categories related to improper authentication and authorization checks, allowing external threats to bypass security controls that are designed to restrict access based on identity verification.
The technical nature of this flaw allows for a high degree of impact due to its ease of exploitation. The attack vector is classified as network-based with low complexity, meaning that automated tools can likely be used to exploit the condition without requiring sophisticated manual intervention or user interaction. Once an attacker successfully leverages this vulnerability, they gain unauthorized access to critical data stored within the Oracle Agile PLM environment. This includes sensitive intellectual property, manufacturing specifications, supplier details, and other proprietary information essential for business operations. The ability to read such data constitutes a severe breach of confidentiality, directly impacting the integrity of the organization's trade secrets and competitive advantage. Furthermore, the vulnerability extends beyond mere data exfiltration by enabling unauthorized actions that can disrupt system availability. Attackers are capable of causing a partial denial of service, which degrades the performance or responsiveness of the Oracle Agile PLM application for legitimate users. This dual impact on both confidentiality and availability underscores the severity of the issue, as it not only compromises data security but also hinders operational continuity.
From an industry standard perspective, this vulnerability maps to several key frameworks that guide risk assessment and remediation efforts. The lack of authentication requirements places it squarely within CWE-287, which describes Improper Authentication, a common root cause for many high-severity web application vulnerabilities. Additionally, the ability to access critical data without authorization relates closely to CWE-862, Missing Authorization, indicating that the system fails to verify if an authenticated user has permission to perform specific actions or view certain resources before granting access. In terms of offensive security tactics, this vulnerability facilitates initial access and potentially privilege escalation within the application layer, aligning with MITRE ATT&CK techniques such as T1078 Valid Accounts if credentials are later harvested from the exposed data, or more directly reflecting patterns associated with unauthenticated remote code execution or information disclosure vectors. The CVSS 3.1 base score of 8.2 reflects these factors, emphasizing high confidentiality impact and low availability impact due to the partial denial of service capability.
The operational impact on an organization utilizing Oracle Agile PLM version 9.3.6 is substantial. Beyond the immediate loss or exposure of sensitive data, which could lead to regulatory penalties under frameworks like GDPR or HIPAA depending on the nature of the information compromised, there are significant reputational and financial consequences. Customers and partners may lose trust in the organization's ability to secure shared supply chain data if such a vulnerability is exploited publicly. The partial denial of service aspect introduces operational friction, potentially delaying product development cycles or procurement processes that rely on real-time access to the PLM system. For security teams, this represents an urgent priority because the low barrier to entry means that automated scanning tools and opportunistic attackers are likely already probing for this specific weakness in internet-facing deployments.
Mitigation strategies must focus primarily on immediate patching and network-level controls until a permanent fix is applied by Oracle. Organizations should apply the latest security patches provided by Oracle for Agile PLM version 9.3.6 as soon as they become available, ensuring that all components including the Application Server are updated to address the underlying code flaws. In the interim, if patching is not immediately feasible due to maintenance windows or dependency constraints, network segmentation should be implemented to restrict access to the Oracle Agile PLM application server exclusively from trusted internal IP ranges. Deploying a Web Application Firewall with rules specifically tuned to detect and block exploitation attempts for this vulnerability can provide an additional layer of defense by filtering malicious HTTP requests before they reach the vulnerable component. Furthermore, enabling strict logging and monitoring on the application server is critical to detecting any signs of attempted or successful exploitation. Security operations centers should monitor for unusual traffic patterns, excessive error responses, or spikes in resource consumption that may indicate a denial-of-service attempt or data exfiltration activity related to this vulnerability.