Threats affecting pkg:maven/com.oracle.agile/agile-plm

CVE-2026-87252 is a vulnerability in Oracle Agile PLM 9.3.6 Application Server component that allows an unauthenticated attacker with access to the physical communication segment to compromise the product. Exploitation can lead to unauthorized creation, deletion, or modification of critical data. The vulnerability has a CVSS 3.1 base score of 6.8, indicating medium severity with high confidentiality and integrity impacts. Oracle has included this vulnerability in its September 2026 Critical Security Patch Update, providing patches for affected versions.

A critical vulnerability exists in Oracle Agile PLM version 9.3.6, specifically in the Event Java PX component. This vulnerability allows a high privileged attacker with network access via T3 or IIOP protocols to compromise the product, potentially resulting in complete takeover. The vulnerability impacts confidentiality, integrity, and availability with a CVSS 3.1 base score of 9.1. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update.