This vulnerability affects Oracle Agile PLM 9.3.6, specifically in the component handling folders, files, and attachments. It allows a low privileged attacker with network access via HTTP to compromise the system, requiring user interaction from a third party. The vulnerability impacts confidentiality and integrity, potentially granting unauthorized access to critical data and the ability to update, insert, or delete some data. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N, reflecting network attack vector, low attack complexity, low privileges required, user interaction required, scope change, high confidentiality impact, low integrity impact, and no availability impact. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which includes 673 security patches across multiple products.

Successful exploitation can result in unauthorized access to critical data within Oracle Agile PLM and unauthorized modification (update, insert, delete) of some accessible data. The vulnerability affects confidentiality and integrity but does not impact availability. The scope of impact may extend beyond Oracle Agile PLM to additional Oracle products due to scope change.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability. Customers are strongly advised to apply the available security patches without delay to mitigate this vulnerability. Oracle recommends remaining on actively supported versions and promptly applying patches. No indication of alternative mitigations or 'no action required' is provided in the advisory.