This vulnerability affects Oracle Agile PLM version 9.3.6, specifically the Application Server component. It requires an attacker to have access to the physical communication segment attached to the hardware running Oracle Agile PLM. Successful exploitation can result in unauthorized creation, deletion, or modification of critical data within Oracle Agile PLM. The CVSS 3.1 vector indicates the attack vector is adjacent network (AV:A), with high attack complexity (AC:H), no privileges required (PR:N), no user interaction (UI:N), unchanged scope (S:U), and high confidentiality and integrity impacts (C:H/I:H), but no availability impact (A:N). Oracle has released patches for this vulnerability as part of their September 2026 Critical Security Patch Update.

An attacker with physical network access can exploit this vulnerability to gain unauthorized access to Oracle Agile PLM data, including the ability to create, delete, or modify critical data. This compromises the confidentiality and integrity of the data managed by Oracle Agile PLM 9.3.6. There is no reported impact on availability. No known exploits are reported in the wild at this time.

Oracle has released a security patch for this vulnerability in the September 2026 Critical Security Patch Update. Customers running Oracle Agile PLM version 9.3.6 should apply the official patch promptly to remediate this issue. Oracle strongly recommends staying on actively supported versions and applying security patches without delay. No alternative mitigations or workarounds are indicated by the vendor advisory.