CVE-2026-46859 affects Oracle Agile PLM version 9.3.6 and is an easily exploitable vulnerability that allows unauthenticated remote attackers with network access via HTTP to compromise the system. The vulnerability impacts confidentiality, integrity, and availability, potentially enabling full system takeover. Oracle has published this issue as part of its June 2026 Critical Security Patch Update, which includes 245 security patches across multiple products. While the advisory does not explicitly confirm a specific patch for Oracle Agile PLM 9.3.6, Oracle strongly recommends applying the Critical Security Patch Update without delay to address this and other vulnerabilities. Temporary mitigations include blocking attack vectors and limiting privileges, though these may affect application functionality.

The vulnerability allows unauthenticated attackers to remotely compromise Oracle Agile PLM 9.3.6 via HTTP, resulting in complete takeover of the product. This includes full loss of confidentiality, integrity, and availability of the affected system. The CVSS 3.1 score of 9.8 reflects the critical severity and the potential for severe operational and data impact if exploited.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update immediately to remediate this vulnerability. The vendor advisory does not specify a standalone patch but indicates that the Critical Security Patch Update addresses this and many other vulnerabilities. Until patches are applied, risk may be reduced by blocking network protocols used in attacks and removing unnecessary privileges from users, though these measures may disrupt normal application functionality. Customers should follow Oracle’s official patch documentation and guidance for installation and mitigation.