Executive Summary

Oracle Agile PLM (9.3.5/9.3.6) vulnerable to low‑privilege HTTP exploitation. Attack requires user interaction but can lead to unauthorized access to critical data. CVSS 3.0 6.8 (Confidentiality). Not listed in CISA KEV.

---

Authoritative CVE Metadata - CVSS Base Score: 6.8 (MEDIUM) - Published: 2017-08-08T15:29:01.380 - Last Modified: 2026-08-25T16:28:27.310

Original Description: Vulnerability in the Oracle Agile PLM component of Oracle Supply Chain Products Suite (subcomponent: Web Client). Supported versions that are affected are 9.3.5 and 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Agile PLM, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Agile PLM accessible data. CVSS 3.0 Base Score 6.8 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N).

"It is difficult to achieve a spirit of genuine cooperation as long as people remain indifferent to the feelings and happiness of others."

— Dalai Lama