This vulnerability affects Oracle Agile PLM version 9.3.6 and is classified under CWE-287 (Improper Authentication). It allows an unauthenticated attacker with network access via HTTP to compromise the Oracle Agile PLM system, resulting in full takeover. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle's June 2026 Critical Security Patch Update advisory references this vulnerability among many others but does not explicitly confirm a patch for version 9.3.6 in the advisory content provided.

Successful exploitation of this vulnerability can lead to complete compromise of Oracle Agile PLM 9.3.6, affecting confidentiality, integrity, and availability of the system. This means attackers could gain unauthorized access, manipulate data, and disrupt service operations.

Oracle strongly recommends applying Critical Security Patch Update security patches as soon as possible. However, the vendor advisory does not explicitly confirm the availability of a patch for Oracle Agile PLM 9.3.6 at this time. Until patches are applied, risk may be reduced by blocking network protocols required by the attack and limiting privileges or access to vulnerable packages for users who do not need them. Customers should monitor the Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for updates on patch availability and apply patches promptly once released.