CVE-2026-71040

CriticalCVSS 9.8

Published: 18/08/2026(UTC)Translated: 19/08/2026(UTC)NVD NIST

Summary

Vulnerability in Oracle Agile PLM (Security component) affects version 9.3.6. An unauthenticated attacker with network access via HTTP can take over Oracle Agile PLM. CVSS score is 9.8.

Risk Assessment

The risk is critical as the attack can lead to full takeover of Oracle Agile PLM, threatening confidentiality, integrity, and availability.

Recommendation

Apply patches provided by Oracle for version 9.3.6. Restrict access to the HTTP interface to trusted networks only.

Original NVD description (English source)

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Security). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks of this vulnerability can result in takeover of Oracle Agile PLM. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).