Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Folders, Files & Attachments). (CVE-2026-87258)
CVE-2026-87258 is a vulnerability in Oracle Agile PLM 9.3.6 affecting the Folders, Files & Attachments component. It allows a low privileged attacker with network access via HTTP to potentially gain unauthorized access to critical data or modify some data after successful exploitation, which requires user interaction. The vulnerability impacts confidentiality and integrity but not availability. Oracle has released a Critical Security Patch Update addressing this and many other vulnerabilities.
AI Analysis
Technical Summary
This vulnerability in Oracle Agile PLM 9.3.6 involves the Folders, Files & Attachments component and can be exploited remotely over HTTP by an attacker with low privileges. Exploitation requires user interaction from a third party and can lead to unauthorized access to critical data or unauthorized modification of accessible data. The CVSS 3.1 base score is 7.6, reflecting high confidentiality impact and low integrity impact, with no availability impact. Oracle's September 2026 Critical Security Patch Update includes fixes for this vulnerability among 673 patches across multiple products.
Potential Impact
Successful exploitation can result in unauthorized access to critical data or complete access to all data accessible via Oracle Agile PLM, as well as unauthorized update, insert, or delete operations on some data. The vulnerability affects confidentiality and integrity, potentially compromising sensitive information and data integrity within Oracle Agile PLM environments.
Mitigation Recommendations
Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability. Customers are strongly advised to apply the provided security patches promptly to mitigate the risk. Oracle recommends remaining on actively-supported versions and applying security patches without delay. No alternative mitigations or workarounds are specified in the advisory.
Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Folders, Files & Attachments). (CVE-2026-87258)
Description
CVE-2026-87258 is a vulnerability in Oracle Agile PLM 9.3.6 affecting the Folders, Files & Attachments component. It allows a low privileged attacker with network access via HTTP to potentially gain unauthorized access to critical data or modify some data after successful exploitation, which requires user interaction. The vulnerability impacts confidentiality and integrity but not availability. Oracle has released a Critical Security Patch Update addressing this and many other vulnerabilities.
CVSS v3.1
Score 7.6high
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in Oracle Agile PLM 9.3.6 involves the Folders, Files & Attachments component and can be exploited remotely over HTTP by an attacker with low privileges. Exploitation requires user interaction from a third party and can lead to unauthorized access to critical data or unauthorized modification of accessible data. The CVSS 3.1 base score is 7.6, reflecting high confidentiality impact and low integrity impact, with no availability impact. Oracle's September 2026 Critical Security Patch Update includes fixes for this vulnerability among 673 patches across multiple products.
Potential Impact
Successful exploitation can result in unauthorized access to critical data or complete access to all data accessible via Oracle Agile PLM, as well as unauthorized update, insert, or delete operations on some data. The vulnerability affects confidentiality and integrity, potentially compromising sensitive information and data integrity within Oracle Agile PLM environments.
Mitigation Recommendations
Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability. Customers are strongly advised to apply the provided security patches promptly to mitigate the risk. Oracle recommends remaining on actively-supported versions and applying security patches without delay. No alternative mitigations or workarounds are specified in the advisory.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-qw85-v7vc-94p8
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-87258"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aaa07d855bf5e2cf5ea2d39
Added to database: 09/16/2026, 03:07:04 UTC
Last enriched: 09/16/2026, 03:23:06 UTC
Last updated: 09/16/2026, 06:01:23 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.