CVE-2026-87257 is a vulnerability in Oracle Agile PLM 9.3.6's SDK component that permits a low privileged attacker with network access via HTTP to compromise the product, resulting in unauthorized access to critical or all accessible data. The vulnerability has a CVSS 3.1 base score of 7.7, with an attack vector of network, low attack complexity, requiring low privileges and no user interaction, and a scope change with high confidentiality impact but no integrity or availability impact. Oracle's September 2026 Critical Security Patch Update includes a fix for this vulnerability among 673 patches across multiple products.

Successful exploitation can result in unauthorized access to critical or all data accessible by Oracle Agile PLM, potentially compromising confidentiality significantly. There is no reported impact on integrity or availability. The vulnerability affects the confidentiality of data within Oracle Agile PLM and may also impact additional products due to scope change.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability. Customers are strongly advised to apply the available security patches promptly and remain on actively-supported versions. Oracle emphasizes that failure to apply patches has led to successful exploitation attempts in the past. No additional mitigation steps are specified beyond applying the official patch.