CVE-2026-87362: 
Oracle Agile PLM vulnerability analysis and mitigation

CVE-2026-87362 is an information disclosure vulnerability in the Oracle Agile PLM product (component: Folders, Files & Attachments) within Oracle's Supply Chain product family. The affected version is 9.3.6. A low-privileged attacker with network access via HTTP can exploit this vulnerability to gain unauthorized access to critical data or complete access to all Oracle Agile PLM accessible data. It carries a CVSS v3.1 base score of 6.5 (Medium), with confidentiality impact only and no integrity or availability impact (Oracle Advisory).

The vulnerability is classified as a file/data disclosure issue (CWE category: unauthorized data access) within the Folders, Files & Attachments component of Oracle Agile PLM 9.3.6. Exploitation requires only low privileges (a valid account with network access via HTTP) and no user interaction, making it easily exploitable under standard network conditions. The attack vector is network-based with low complexity, meaning no special conditions or race conditions are required. No public proof-of-concept or detailed technical write-up has been identified at this time (Oracle Advisory).

Successful exploitation allows a low-privileged attacker to read all data accessible within Oracle Agile PLM, including critical and sensitive product lifecycle management information such as proprietary design files, attachments, and folder contents. The impact is limited to confidentiality — there is no integrity or availability impact — but the breadth of data exposure (complete access to all PLM-accessible data) represents a significant risk for organizations managing sensitive supply chain and product data (Oracle Advisory).

There is no public proof-of-concept exploit available, and no evidence of active in-the-wild exploitation has been observed as of the disclosure date. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is reported as 0.0, indicating a very low probability of exploitation in the near term (Oracle Advisory).

Oracle has released a patch for this vulnerability as part of the Oracle Critical Patch Update (CPU) for October 2026, published on October 20, 2026. Organizations running Oracle Agile PLM version 9.3.6 should apply the patch immediately by following the instructions in the Oracle Supply Chain Patch Availability Document. As a temporary measure, restricting network access to Oracle Agile PLM to only trusted users and systems, and monitoring access logs for unauthorized data access attempts, can reduce risk until patching is complete (Oracle Advisory).