CVE-2026-46859: Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Security)

Synopsis

An authentication bypass and full-system takeover vulnerability exists in the Security component of Oracle Agile PLM version 9.3.6, part of the Oracle Supply Chain suite. The flaw is reachable over a standard HTTP network connection with no credentials required and no user interaction needed, making it trivially exploitable by any attacker who can reach the service. Successful exploitation results in complete takeover of the Oracle Agile PLM instance, giving the attacker full control over confidentiality, integrity, and availability. No fix version has been published yet; HarborGuard tracks this advisory and will make a patched-image rebuild available the moment Oracle ships an upstream fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the Oracle Agile PLM service over the network via HTTP; AV:N means any host with network access to the exposed endpoint is in scope.

• AuthenticationNot required

  No credentials of any kind are needed; PR:N means an unauthenticated attacker can send a direct exploit payload to the service.

• Victim interactionNot required

  No user action is required; UI:N means the attack completes without any interaction from a logged-in user or administrator.

• Attack complexityDetail

  Attack complexity is Low (AC:L), meaning the exploit is reliable and repeatable with no dependency on race conditions, memory layout, or other environmental factors.

Blast Radius

• A successful attacker reads all data stored in Oracle Agile PLM, including product lifecycle records, design files, supplier data, and stored credentials.
• The attacker can modify or delete persisted PLM records, corrupt product definitions, and tamper with supply chain workflows.
• The attacker can crash or render the Oracle Agile PLM service unavailable, disrupting any business process that depends on it.
• Full system takeover means the attacker can establish persistent access, pivot to connected systems on the same network segment, and exfiltrate data continuously.