This vulnerability affects Oracle Agile PLM version 9.3.6 and allows an unauthenticated attacker to remotely compromise the system over HTTP without any privileges or user interaction. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory references this vulnerability among many others but does not explicitly confirm a patch or remediation level for this specific version. Customers are advised to consult the advisory for patch availability and apply updates promptly.

The vulnerability allows complete compromise of Oracle Agile PLM 9.3.6 by unauthenticated remote attackers via HTTP. This can lead to full system takeover, affecting confidentiality, integrity, and availability of the product. The critical CVSS score of 9.8 reflects the severity and ease of exploitation without any required privileges or user interaction.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. However, the advisory content does not explicitly confirm the availability of a patch for Oracle Agile PLM version 9.3.6. Customers should review the official Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. Oracle strongly recommends applying security patches without delay and remaining on actively-supported versions. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.