This vulnerability affects Oracle Agile PLM 9.3.6 and allows an unauthenticated attacker to exploit the system remotely over HTTP without any privileges or user interaction. Successful exploitation can lead to complete compromise of Oracle Agile PLM, impacting confidentiality, integrity, and availability. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle's advisory references this vulnerability as part of their August 2026 Critical Security Patch Update but does not provide explicit patch details for this version in the input data.

The vulnerability allows an unauthenticated remote attacker to fully compromise Oracle Agile PLM 9.3.6, resulting in complete loss of confidentiality, integrity, and availability of the affected system. This could lead to unauthorized data access, modification, and service disruption or takeover of the Oracle Agile PLM environment.

Oracle strongly recommends applying security patches without delay and remaining on actively supported versions. Although the vendor advisory references a Critical Security Patch Update released in August 2026, it does not explicitly confirm patch availability for Oracle Agile PLM 9.3.6 in the provided data. Therefore, patch status is not yet confirmed—check the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for current remediation guidance. Until a patch is applied, restrict network access to Oracle Agile PLM and monitor for suspicious activity related to this vulnerability.