CVE-2026-101562

Awaiting Analysis Awaiting Analysis - Queue

Unauthenticated Data Access in Oracle Agile PLM

Publication date: 2026-10-20

Last updated on: 2026-11-06

Assigner: Oracle

Description

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Acollect). The supported version that is affected is 2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Agile PLM accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-11-06

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-101562

EUVD

EUVD-2026-105971

Affected Vendors & Products

Vendor	Product	Version / Range
Oracle Corporation	Oracle Agile PLM	2.6

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Agile PLM version 2.6. It allows an unauthenticated attacker with network access via HTTP to compromise the system. Successful exploitation can lead to unauthorized access to critical data or full access to all data accessible by Oracle Agile PLM.

Detection Guidance

Detecting this vulnerability requires checking for Oracle Agile PLM version 2.6 exposed via HTTP. Scan network ports for Oracle Agile PLM services and verify if the version matches 2.6. Use tools like nmap to identify open ports and services running on the network.

Impact Analysis

An attacker could gain access to sensitive data stored in Oracle Agile PLM, including confidential business or personal information. This could lead to data breaches, loss of intellectual property, or unauthorized modifications to critical data.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR, HIPAA, or other regulations due to unauthorized data access or disclosure. Organizations may face legal penalties, fines, or reputational damage if such breaches occur.

Mitigation Strategies

Immediately upgrade Oracle Agile PLM to a version beyond 2.6 if available. If upgrading is not possible, restrict network access to the Oracle Agile PLM server via firewalls or network segmentation. Disable HTTP access if HTTPS is available and properly configured.

Hi! I’m here to help you understand CVE-2026-101562. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...