This vulnerability affects Oracle Agile PLM version 9.3.6 and allows a low privileged attacker who has logon access to the infrastructure where Oracle Agile PLM runs to compromise the product. The vulnerability impacts confidentiality, potentially granting unauthorized access to critical or all data accessible by Oracle Agile PLM. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) indicates local attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high confidentiality impact without integrity or availability impact. The vendor advisory from Oracle does not explicitly confirm a patch or remediation for this specific vulnerability but references a Critical Patch Update containing many fixes. Users should consult the July 2026 Oracle Critical Patch Update advisory for detailed patch availability.

Successful exploitation can result in unauthorized access to critical data or complete access to all data accessible by Oracle Agile PLM, compromising confidentiality. The vulnerability may also affect additional Oracle products due to scope change. There is no indication of impact on integrity or availability. The CVSS score of 6.5 reflects a medium severity with significant confidentiality impact.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends applying Critical Patch Updates promptly and staying on actively supported versions. Until a patch is confirmed and applied, restrict infrastructure access to trusted users only to reduce risk.