This vulnerability affects Oracle Agile PLM version 9.3.6 and allows an attacker with low privileges and network access over HTTP to compromise the product. The vulnerability impacts confidentiality, potentially allowing unauthorized access to critical or all accessible data within Oracle Agile PLM. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high confidentiality impact. Oracle has included a fix for this vulnerability in its September 2026 Critical Security Patch Update, which contains 673 security patches across many Oracle products. Customers are strongly advised to apply the patch promptly to mitigate the risk.

Successful exploitation can result in unauthorized access to critical or all data accessible by Oracle Agile PLM 9.3.6. The vulnerability affects confidentiality only, with no direct impact on integrity or availability. The scope change indicates that the attack may affect additional products beyond Oracle Agile PLM. The CVSS score of 7.7 reflects a high severity due to the potential for significant data exposure.

Oracle has released an official fix for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers using Oracle Agile PLM version 9.3.6 should apply the provided patch without delay. Oracle strongly recommends remaining on actively supported versions and promptly applying security patches to prevent exploitation. No additional mitigation steps are indicated beyond applying the official patch.