{"id":"CVE-2026-101719","kind":"vulnerability","aliases":["CVE-2026-101719"],"related":[],"title":"Oracle Agile PLM: application server flaw allows unauthenticated takeover over HTTP","description":"Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Application Server).   The supported version that is affected is 9.3.6. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Agile PLM. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).","summary":"Oracle Agile PLM's Application Server component has a flaw that an unauthenticated attacker can reach over HTTP. A successful attack can take over the Oracle Agile PLM instance, but it needs a person other than the attacker to take an action.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle Agile PLM","fixed":[],"affected":"9.3.6","ecosystem":"vendor"}],"ecosystems":[],"tags":["oracle","oracle-agile-plm","other","product-lifecycle-management","self-hosted"],"not_affected_if":[],"how_to_check":"Check your Oracle Agile PLM version: if it is 9.3.6 and the Application Server is reachable over HTTP, you are in scope. Then confirm in My Oracle Support (Oracle Supply Chain Products patch availability document for the October 2026 CPU) whether the CPU patch is applied.","fix":"Apply the October 2026 Oracle Critical Patch Update for Oracle Agile PLM 9.3.6, per the Oracle Supply Chain Products patch availability document in My Oracle Support. The exact patch number is not public (unknown).","status":"open","published_at":"2026-10-20T22:18:26+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","triaged_at":"2026-10-25T03:19:05+00:00","updated_at":"2026-10-25T03:25:54+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T03:19:05Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Oracle Agile PLM: application server flaw allows unauthenticated takeover over HTTP","impact":"high","summary":"Oracle Agile PLM's Application Server component has a flaw that an unauthenticated attacker can reach over HTTP. A successful attack can take over the Oracle Agile PLM instance, but it needs a person other than the attacker to take an action.","category":"other","nicknames":[],"who_cares":["oracle-agile-plm","product-lifecycle-management"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker takes over the Oracle Agile PLM instance and its data","analyst_note":"Check Oracle's Critical Patch Update advisory and the NVD entry for patched versions, affected configurations, and how_to_check guidance.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organizations running Oracle Agile PLM 9.3.6 with the Application Server component reachable over the network. The sources do not say which deployment configurations are exposed, so whether a given instance is affected cannot be confirmed from this text.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000567,"input_tokens":3465,"output_tokens":441,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check Oracle's Critical Patch Update advisory and the NVD entry for patched versions, affected configurations, and how_to_check guidance.","search":"'-101719':14A,17A '-2026':13A,16A '/av':154C '3.1':141C,153C '7.5':144C '9.3.6':97C 'access':107C 'action':75B 'affect':95C 'agil':2A,24B,35B,60B,80C,113C,138C 'agile':19A 'allow':7A,102C 'applic':4A,38B,88C 'attack':47B,54B,71B,104C,116C,126C,128C 'avail':148C 'base':142C 'chain':86C 'compon':40B,87C 'compromis':111C 'confidenti':145C 'cve':12A,15A 'cvss':140C,150C,152C 'difficult':98C 'exploit':100C 'flaw':6A,43B 'h':162C 'h/a':161C 'h/i':160C 'h/pr':156C 'host':33B 'http':11A,51B,109C 'human':118C 'impact':149C 'instanc':62B 'integr':146C 'interact':119C 'lifecycl':29B 'manag':30B 'n/ac':155C 'n/ui':157C 'need':65B 'network':106C 'oracl':1A,21B,23B,34B,59B,79C,84C,112C,137C 'oracle':18A 'oracle-agile-plm':22B 'person':67B,122C 'plm':3A,20A,25B,36B,61B,81C,114C,139C 'product':28B,82C 'product-lifecycle-manag':27B 'r/s':158C 'reach':49B 'requir':117C 'result':133C 'score':143C 'self':32B 'self-host':31B 'server':5A,39B,89C 'success':53B,115C,127C 'suppli':85C 'support':91C 'take':56B,73B 'takeov':9A,135C 'u/c':159C 'unauthent':8A,46B,103C 'vector':151C 'version':92C 'via':108C 'vulner':76C,101C,131C","nicknames":[],"mitigations":[],"who_affected":"Teams running self-hosted Oracle Agile PLM 9.3.6 whose Application Server is reachable over HTTP. Exploitation is rated difficult and needs a person other than the attacker to take an action, so the risk is lower on instances kept off the internet. Teams not running Agile PLM can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:26+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101719","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101719","severity":null,"published_at":"2026-10-20T22:18:26+00:00","modified_at":"2026-10-22T16:17:14+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","fetched_at":"2026-10-23T22:28:59+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-101719:713","url":null,"severity":null,"published_at":"2026-10-25T03:25:54+00:00","modified_at":"2026-10-25T03:25:54+00:00","first_seen_at":"2026-10-25T03:25:54+00:00","fetched_at":"2026-10-25T03:25:54+00:00","note":"Read Oracle CPU Oct 2026 page and NVD: affects Agile PLM 9.3.6 only (CPU table also lists 2.6 for the product generally, not tied to this CVE). Fixed build number is in the MOS patch availability doc (login required), not readable; no exploitation or PoC found; no KEV."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3167,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101719","title":"NVD CVE-2026-101719","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}