This vulnerability affects Oracle Agile PLM version 9.3.6 and allows an unauthenticated attacker with network access via HTTP to gain unauthorized access and control over critical data. The attacker can create, delete, or modify data without authentication, resulting in a complete compromise of data confidentiality and integrity. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) reflects that the attack requires no privileges or user interaction and can be performed remotely over the network. The vulnerability is listed in Oracle's July 2026 Critical Patch Update advisory, which contains numerous patches for multiple products, but the advisory does not explicitly confirm a patch or fix for Oracle Agile PLM 9.3.6 in the provided excerpt.

Successful exploitation results in unauthorized creation, deletion, or modification of critical data within Oracle Agile PLM 9.3.6, as well as unauthorized access to all data accessible through the product. This compromises the confidentiality and integrity of sensitive data, potentially leading to significant business and operational impacts. There is no indication of availability impact (no denial of service).

Oracle has released a Critical Patch Update in July 2026 addressing multiple vulnerabilities across its product portfolio, including Oracle Agile PLM. However, the provided advisory content does not explicitly confirm a patch for version 9.3.6 of Oracle Agile PLM. Customers should consult the official Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until a patch is confirmed and applied, restrict network access to Oracle Agile PLM instances to trusted users only and monitor for suspicious activity.