CVE-2026-87362 in Agile PLM
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Folders, Files & Attachments). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Agile PLM accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Folders, Files & Attachments component of Oracle Agile Product Lifecycle Management version 9.3.6, a critical module responsible for managing document storage and retrieval within supply chain operations. This security flaw is characterized by an access control misconfiguration that permits low-privileged users to bypass intended restrictions on sensitive data repositories. The vulnerability stems from insufficient validation or enforcement mechanisms when handling HTTP requests directed at file management endpoints, allowing attackers with basic network connectivity to interact with system resources beyond their authorized scope.
From a technical perspective, the flaw enables unauthorized retrieval of critical business documents and proprietary information stored within the Agile PLM environment. Because the exploitation vector is remote via HTTP and requires no user interaction or complex preconditions, it presents a significant risk surface for organizations relying on this platform for collaborative product development and supply chain coordination. The attacker needs only low-level privileges to initiate the exploit, which lowers the barrier to entry significantly compared to vulnerabilities requiring administrative access or physical proximity.
The operational impact of successful exploitation is severe regarding data confidentiality, as indicated by the high severity score in that domain. Attackers can exfiltrate sensitive design specifications, supplier contracts, cost analyses, and other proprietary intellectual property accessible through the Agile PLM interface. While integrity and availability impacts are currently assessed as none, the loss of confidential data alone poses substantial risks including competitive disadvantage, regulatory non-compliance under frameworks such as GDPR or HIPAA if applicable data is exposed, and potential reputational damage to the affected organization.
This vulnerability aligns with CWE-284 Improper Access Control, specifically reflecting failures in enforcing user authorization policies on sensitive resources. In terms of offensive security tactics, it maps closely to ATT&CK technique T1078 Valid Accounts, where attackers leverage legitimate but low-level credentials to access restricted information without triggering typical intrusion detection alerts associated with privilege escalation or brute force attacks. The absence of required user interaction further classifies this as a straightforward exploitation scenario that could be automated by threat actors scanning for vulnerable instances on the internet.
Mitigation strategies should prioritize immediate patching to the latest supported version of Oracle Agile PLM where these access control checks have been hardened. In environments where patching is not immediately feasible, network segmentation and strict firewall rules limiting HTTP access to only authorized IP ranges can reduce exposure. Additionally, implementing Web Application Firewall policies that monitor for anomalous file download patterns or excessive data retrieval by low-privileged accounts may help detect attempted exploitation in real time. Regular audits of user permissions and enforcement of the principle of least privilege across all Agile PLM roles are essential preventive measures to minimize the attack surface associated with this component.