---
id: "CVE-2026-101719"
kind: "vulnerability"
aliases: ["CVE-2026-101719"]
title: "Oracle Agile PLM: application server flaw allows unauthenticated takeover over HTTP"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Oracle Agile PLM", "fixed": [], "affected": "9.3.6", "ecosystem": "vendor"}]
ecosystems: []
tags: ["oracle", "oracle-agile-plm", "other", "product-lifecycle-management", "self-hosted"]
not_affected_if: []
published_at: "2026-10-20T22:18:26+00:00"
first_seen_at: "2026-10-23T21:57:23+00:00"
updated_at: "2026-10-25T03:25:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101719", "first_seen_at": "2026-10-23T21:57:23+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-25T03:25:54+00:00"}]
---

# Oracle Agile PLM: application server flaw allows unauthenticated takeover over HTTP

Oracle Agile PLM's Application Server component has a flaw that an unauthenticated attacker can reach over HTTP. A successful attack can take over the Oracle Agile PLM instance, but it needs a person other than the attacker to take an action.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle Agile PLM affected 9.3.6 fixed ?

## How to check

Check your Oracle Agile PLM version: if it is 9.3.6 and the Application Server is reachable over HTTP, you are in scope. Then confirm in My Oracle Support (Oracle Supply Chain Products patch availability document for the October 2026 CPU) whether the CPU patch is applied.

## Fix

Apply the October 2026 Oracle Critical Patch Update for Oracle Agile PLM 9.3.6, per the Oracle Supply Chain Products patch availability document in My Oracle Support. The exact patch number is not public (unknown).

## Timeline

- 2026-10-23T21:57:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101719
- 2026-10-25T03:25:54+00:00 analyst — Read Oracle CPU Oct 2026 page and NVD: affects Agile PLM 9.3.6 only (CPU table also lists 2.6 for the product generally, not tied to this CVE). Fixed build number is in the MOS patch availability doc (login required), not readable; no exploitation or PoC found; no KEV.

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [describes] NVD CVE-2026-101719 https://nvd.nist.gov/vuln/detail/CVE-2026-101719

## From the sources

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Application Server).   The supported version that is affected is 9.3.6. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Agile PLM. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_