This vulnerability affects Oracle Agile PLM version 9.3.6 and involves a security weakness that allows a low privileged attacker who has logon access to the infrastructure where Oracle Agile PLM runs to compromise the product. The attack can result in unauthorized access to critical data or full access to all data accessible by Oracle Agile PLM. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) indicates that the attack requires local access with low complexity and privileges, no user interaction, and results in a confidentiality impact with scope change. Oracle's July 2026 Critical Patch Update advisory mentions this vulnerability but does not explicitly confirm a patch or remediation level for it. Customers are urged to stay on supported versions and apply patches promptly. No known exploits in the wild have been reported.

Successful exploitation allows unauthorized access to critical or all data accessible by Oracle Agile PLM, potentially compromising confidentiality. The vulnerability affects confidentiality only, with no direct impact on integrity or availability. The scope change indicates that other products integrated or dependent on Oracle Agile PLM may also be impacted.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until an official patch is confirmed, restrict local access to the infrastructure running Oracle Agile PLM to trusted users only.