This vulnerability affects Oracle Agile PLM version 9.3.6 and involves a security flaw that can be exploited remotely without authentication over HTTP. The CVSS 3.1 base score is 8.1, indicating high severity with impacts on confidentiality, integrity, and availability. The vulnerability is described as difficult to exploit but successful exploitation can result in complete takeover of the Oracle Agile PLM product. Oracle's July 2026 Critical Patch Update advisory lists this vulnerability among many others but does not explicitly confirm the availability of a patch or remediation level for this specific issue.

Successful exploitation of this vulnerability can lead to full compromise of Oracle Agile PLM 9.3.6, including unauthorized access and control over the system, resulting in confidentiality, integrity, and availability impacts. This could allow an attacker to take over the affected system remotely without authentication.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively-supported versions. Until a patch is confirmed, organizations should monitor Oracle advisories for updates and consider restricting network access to Oracle Agile PLM instances where feasible.