CVE-2026-87253

Analyzed Analyzed - Analysis Complete

Cross-Site Scripting in Oracle Agile PLM

Publication date: 2026-09-15

Last updated on: 2026-09-23

Assigner: Oracle

Description

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Web Client). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Agile PLM, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Agile PLM accessible data as well as unauthorized read access to a subset of Oracle Agile PLM accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-09-23

Generated

2026-10-06

AI Q&A

2026-09-16

EPSS Evaluated

2026-10-04

NVD

CVE-2026-87253

EUVD

EUVD-2026-79907

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	agile_product_lifecycle_management	9.3.6

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Agile PLM version 9.3.6. It allows an unauthenticated attacker with network access via HTTP to potentially compromise the system. The attack requires human interaction from someone other than the attacker and may impact additional products.

Detection Guidance

Detection requires monitoring for unauthorized access attempts or unusual activity in Oracle Agile PLM via HTTP. Check web server logs for suspicious requests targeting the Web Client component. Look for repeated failed login attempts or unexpected data modifications. Ensure network traffic analysis tools are inspecting HTTP traffic to the Oracle Agile PLM server.

Impact Analysis

Successful exploitation could lead to unauthorized access to data, including the ability to read, update, insert, or delete some Oracle Agile PLM data. The impact includes confidentiality and integrity breaches with a CVSS score of 6.1.

Compliance Impact

The vulnerability allows unauthorized read, insert, update, or delete access to Oracle Agile PLM data, which could expose sensitive information. This may impact compliance with GDPR or HIPAA if personal or health data is compromised. However, specific compliance impacts are not detailed in the provided CVE data.

Mitigation Strategies

Apply the latest security patches from Oracle for Oracle Agile PLM version 9.3.6. Restrict network access to the Web Client component via HTTP. Monitor for unauthorized data access or modifications. Ensure all users are authenticated before granting access to sensitive data.

Hi! I’m here to help you understand CVE-2026-87253. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70