This vulnerability affects Oracle Agile PLM 9.3.6, specifically the Web Client component. It allows an unauthenticated attacker with network access via HTTP to exploit the system, requiring user interaction from a third party. The vulnerability can result in unauthorized read and modification (update, insert, delete) of accessible data within Oracle Agile PLM. The scope of impact may extend beyond Oracle Agile PLM to other products. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope change, and low confidentiality and integrity impacts with no availability impact. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which includes patches for Oracle Agile PLM 9.3.6.

Successful exploitation can lead to unauthorized read access and unauthorized update, insert, or delete access to some data accessible by Oracle Agile PLM. The vulnerability affects confidentiality and integrity of data but does not impact availability. The attack requires user interaction from a person other than the attacker and network access via HTTP. Additionally, the vulnerability's impact scope may extend to other Oracle products beyond Agile PLM.

Oracle has released a security patch for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers using Oracle Agile PLM version 9.3.6 are strongly advised to apply the provided patch promptly to remediate this vulnerability. Oracle recommends remaining on actively supported versions and applying security patches without delay to prevent exploitation.