CVE-2026-47009: Oracle Agile PLM Information Disclosure

CVE-2026-47009 Overview

CVE-2026-47009 is an information disclosure vulnerability in the Oracle Agile PLM product of Oracle Supply Chain. The flaw resides in the Folders, Files & Attachments component of version 9.3.6. An unauthenticated attacker with network access via HTTP can exploit the vulnerability, provided a user other than the attacker performs an action to complete the attack chain. Successful exploitation results in unauthorized access to critical data or complete access to all Oracle Agile PLM accessible data. Oracle addressed the issue in the July 2026 Critical Patch Update. The vulnerability is categorized under [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Successful exploitation grants an unauthenticated remote attacker unauthorized read access to all Oracle Agile PLM accessible data, exposing intellectual property and supply chain records.

Affected Products

Oracle Agile PLM 9.3.6
Oracle Supply Chain (Folders, Files & Attachments component)
Deployments exposing Oracle Agile PLM over HTTP

Discovery Timeline

2026-07-21 - CVE-2026-47009 published to NVD as part of Oracle Critical Patch Update July 2026
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-47009

Vulnerability Analysis

The vulnerability affects the Folders, Files & Attachments component of Oracle Agile PLM 9.3.6. This component manages product lifecycle documents, engineering change orders, and attachments that support supply chain workflows. The weakness maps to [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor, indicating the component discloses protected data to an actor lacking authorization. An attacker reaches the vulnerable endpoint over HTTP without credentials. Exploitation requires a second user to interact with attacker-controlled content, which is characteristic of client-assisted disclosure flaws such as reflected content leaks or crafted attachment handling. Impact is limited to confidentiality, with no reported impact on integrity or availability.

Root Cause

Oracle has not published detailed root cause information. Based on the [CWE-200] classification and the affected component, the flaw stems from improper access control enforcement or inadequate sanitization within the attachment and folder handling logic. The component returns sensitive resources to an unauthenticated request when a legitimate user is induced to trigger the flow.

Attack Vector

The attack vector is network-based over HTTP. An unauthenticated attacker crafts a request or URL targeting the Oracle Agile PLM Folders, Files & Attachments component. The attacker then persuades a legitimate user to interact with the crafted resource, for example by clicking a link. When the interaction occurs, the vulnerable component returns data that should be protected. The result is complete confidentiality compromise of Oracle Agile PLM accessible data.

No verified proof-of-concept code is publicly available for CVE-2026-47009.
Refer to the Oracle Critical Patch Update July 2026 advisory for vendor-supplied technical details.

Detection Methods for CVE-2026-47009

Indicators of Compromise

Unauthenticated HTTP requests to Oracle Agile PLM endpoints that return Folders, Files & Attachments content in responses.
Anomalous outbound data transfers from Oracle Agile PLM servers correlated with user click events on external links.
Access log entries showing repeated requests to attachment or folder retrieval URLs from single IPs without preceding authentication.

Detection Strategies

Enable and centralize Oracle Agile PLM HTTP access logs, then alert on unauthenticated requests to attachment retrieval paths.
Monitor web application firewall telemetry for HTTP requests carrying unusual query parameters targeting the Agile PLM folder or attachment handlers.
Correlate email gateway logs and endpoint browser telemetry with Agile PLM access logs to identify user-interaction driven exploit attempts.

Monitoring Recommendations

Ingest Oracle Agile PLM application and web server logs into a centralized SIEM for retention and correlation.
Track baseline request volumes to the Folders, Files & Attachments endpoints and alert on statistical deviations.
Review outbound network flows from Agile PLM hosts for large or unusual document transfers to untrusted destinations.

How to Mitigate CVE-2026-47009

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update for Oracle Agile PLM 9.3.6 as soon as testing allows.
Restrict network access to Oracle Agile PLM to trusted internal networks and VPN users only.
Educate users to avoid clicking untrusted links that reference internal Agile PLM URLs, since exploitation requires user interaction.
Audit recent access logs for signs of the described exploitation pattern.

Patch Information

Oracle released a fix for CVE-2026-47009 in the July 2026 Critical Patch Update. Administrators should consult the Oracle Critical Patch Update July 2026 advisory for patch bundle identifiers and installation procedures for Oracle Agile PLM 9.3.6.

Workarounds

Place Oracle Agile PLM behind a web application firewall and block anonymous HTTP requests to attachment and folder endpoints.
Enforce network segmentation so the Agile PLM tier is not reachable from user workstation subnets except through a controlled reverse proxy.
Disable or restrict any Agile PLM features that expose the Folders, Files & Attachments component to unauthenticated sessions until the patch is applied.

bash

# Example: restrict access to Oracle Agile PLM at the reverse proxy tier
# nginx snippet - allow only trusted subnets to reach the attachment endpoints
location /Agile/ {
    allow 10.0.0.0/8;
    allow 192.168.0.0/16;
    deny all;
    proxy_pass http://agile-plm-backend;
}