This vulnerability affects Oracle Agile PLM version 9.3.6 and allows an unauthenticated attacker with network access via HTTP to compromise the product, resulting in unauthorized access to critical or all accessible data. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, and high confidentiality impact with no integrity or availability impact. The vulnerability is publicly disclosed and listed in Oracle's July 2026 Critical Patch Update advisory, which includes numerous patches across Oracle products. However, the advisory does not explicitly confirm a patch or mitigation for this specific vulnerability.

Successful exploitation can lead to unauthorized access to critical data or complete access to all data accessible through Oracle Agile PLM version 9.3.6. This compromises confidentiality but does not affect integrity or availability according to the CVSS vector. The vulnerability is exploitable remotely without authentication, increasing risk.

Oracle's July 2026 Critical Patch Update advisory lists this vulnerability among many others but does not explicitly confirm a patch or remediation for Oracle Agile PLM 9.3.6. Customers are strongly advised to review the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and apply any relevant patches promptly. Until an official patch or mitigation is confirmed, restrict network access to Oracle Agile PLM instances where possible to limit exposure. Monitor Oracle's advisories for updates on remediation status.