This vulnerability affects Oracle Agile PLM version 9.3.6 and is related to security weaknesses in authentication and authorization controls (CWE-306, CWE-287, CWE-269, CWE-284). It allows an attacker with low privileges and network access via HTTP to fully compromise the Oracle Agile PLM system. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory includes this vulnerability among many others but does not explicitly state patch availability or remediation details for Oracle Agile PLM 9.3.6. The vendor strongly recommends applying available patches promptly and staying on supported versions.

Successful exploitation can lead to complete takeover of Oracle Agile PLM 9.3.6, affecting confidentiality, integrity, and availability of the system. This could allow unauthorized access, modification, or disruption of the product's functions and data.

Oracle's Critical Patch Update advisory for July 2026 references this vulnerability but does not explicitly confirm patch availability for Oracle Agile PLM 9.3.6. Customers should consult the official Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch information and apply any relevant updates without delay. Oracle recommends remaining on actively-supported versions and applying security patches promptly. Until a patch is confirmed and applied, restrict network access to Oracle Agile PLM and monitor for suspicious activity.