This vulnerability affects Oracle Agile PLM version 9.3.6 and involves a security flaw in the Application Server component. It requires an attacker to have physical access to the communication segment connected to the hardware where Oracle Agile PLM runs. Exploitation can result in unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by Oracle Agile PLM. The CVSS 3.1 vector indicates the attack vector is adjacent network (AV:A), attack complexity is high (AC:H), no privileges required (PR:N), no user interaction (UI:N), and impacts confidentiality and integrity with high severity (C:H/I:H) but no impact on availability (A:N). Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which includes patches for Oracle Agile PLM 9.3.6.

Successful exploitation of this vulnerability can lead to unauthorized creation, deletion, or modification of critical data or full unauthorized access to all data accessible by Oracle Agile PLM. This compromises the confidentiality and integrity of the data but does not affect availability. The attack requires physical access to the communication segment, making exploitation difficult.

Oracle has released patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Users of Oracle Agile PLM version 9.3.6 are strongly advised to apply the available security patches without delay to mitigate this vulnerability. Oracle recommends remaining on actively supported versions and promptly applying security updates to prevent exploitation.