This vulnerability affects Oracle Agile PLM 9.3.6 and allows an unauthenticated attacker with network access over HTTP to compromise the application. Successful exploitation can lead to unauthorized access to critical or all accessible data within Oracle Agile PLM and can cause a partial denial of service. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, high confidentiality impact, no integrity impact, and low availability impact. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which includes targeted security fixes for Oracle Agile PLM and other products.

An attacker can gain unauthorized access to sensitive or all accessible data in Oracle Agile PLM 9.3.6 without authentication, potentially leading to data breaches. The attacker can also cause a partial denial of service, impacting availability of the service. The confidentiality impact is high, while availability impact is low. There is no impact on data integrity. No known exploits in the wild have been reported at this time.

Oracle has released a security patch for Oracle Agile PLM 9.3.6 as part of the September 2026 Critical Security Patch Update. Customers are strongly advised to apply this patch promptly to remediate the vulnerability. Oracle recommends remaining on actively-supported versions and applying security patches without delay to prevent exploitation. Patch availability and installation instructions are provided in the Oracle advisory at https://www.oracle.com/security-alerts/cspusep2026.html.