This vulnerability in Oracle Agile PLM 9.3.6 involves the Folders, Files & Attachments component and permits an unauthenticated remote attacker to compromise the system via HTTP. Successful exploitation requires user interaction by a third party. The impact is unauthorized access to critical or all accessible data within Oracle Agile PLM. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) highlights network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high confidentiality impact without integrity or availability impact. No known exploits in the wild have been reported. The vendor advisory does not explicitly confirm patch availability for this specific vulnerability but references a large Critical Patch Update released in July 2026 covering multiple products.

Successful exploitation can lead to unauthorized access to critical or all accessible data in Oracle Agile PLM 9.3.6. The confidentiality of sensitive information is compromised, but integrity and availability are not affected. The attack requires user interaction, limiting automated exploitation. No public exploits are currently known.

The vendor advisory references the July 2026 Critical Patch Update containing numerous security patches but does not explicitly confirm a patch for this vulnerability. Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until a patch is confirmed and applied, limit network exposure of Oracle Agile PLM and educate users to avoid interaction with suspicious content that could trigger exploitation.