CVE-2026-71040: Oracle Agile PLM Auth Bypass Vulnerability

CVE-2026-71040 Overview

CVE-2026-71040 is a critical vulnerability in the Security component of Oracle Agile PLM, part of Oracle Supply Chain. The flaw affects version 9.3.6 and allows unauthenticated attackers with network access via HTTP to compromise the application. Successful exploitation results in complete takeover of Oracle Agile PLM, impacting confidentiality, integrity, and availability. The weakness is categorized under [CWE-284] Improper Access Control. Oracle addressed the issue in a security alert published in August 2026.

Critical Impact
Unauthenticated network attackers can fully compromise Oracle Agile PLM 9.3.6, gaining control over sensitive product lifecycle data and business processes.

Affected Products

Oracle Agile PLM 9.3.6
Oracle Supply Chain (Agile PLM component: Security)

Discovery Timeline

2026-08-18 - CVE-2026-71040 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-71040

Vulnerability Analysis

CVE-2026-71040 resides in the Security component of Oracle Agile PLM 9.3.6. Oracle characterizes it as easily exploitable by an unauthenticated attacker with network access over HTTP. Successful attacks result in full takeover of the Agile PLM instance, compromising confidentiality, integrity, and availability.

Oracle Agile PLM manages product records, engineering change orders, bills of materials, and supplier data. A takeover exposes intellectual property and lets adversaries tamper with manufacturing records or pivot into connected ERP and supply-chain systems.

Oracle's advisory does not disclose exploitation specifics. However, the combination of unauthenticated access and HTTP-based attack surface indicates a flaw in request-handling or access-control logic within the Security component.

Root Cause

The vulnerability maps to [CWE-284] Improper Access Control. The Security component fails to correctly enforce authorization boundaries on requests reaching it over HTTP. Attackers can invoke privileged functionality without presenting valid credentials or bypass the checks that protect sensitive operations.

Attack Vector

Attackers deliver crafted HTTP requests directly to an exposed Oracle Agile PLM 9.3.6 endpoint. No authentication, user interaction, or elevated privileges are required. The attack succeeds against internet-facing deployments as well as internal instances reachable through compromised network segments.

Refer to the Oracle Security Alert for vendor-provided technical details.

Detection Methods for CVE-2026-71040

Indicators of Compromise

Unexpected HTTP requests to Oracle Agile PLM endpoints from unknown or external source addresses.
New or modified administrative user accounts inside Agile PLM without a corresponding change ticket.
Anomalous outbound connections from the Agile PLM application server to attacker-controlled infrastructure.
Unusual access to product records, engineering change orders, or bill-of-materials data outside business hours.

Detection Strategies

Inspect web server and application logs for HTTP requests that bypass authentication flows or access privileged Security component URLs.
Correlate authentication events with subsequent privileged actions to identify sessions that skipped login.
Baseline expected Agile PLM traffic patterns and alert on deviations in request volume, method distribution, or user-agent strings.

Monitoring Recommendations

Enable verbose logging for the Agile PLM Security component and forward logs to a centralized SIEM.
Monitor Java application server processes hosting Agile PLM for unexpected child processes or file writes.
Track database queries against Agile PLM schemas for mass reads of product or supplier tables.

How to Mitigate CVE-2026-71040

Immediate Actions Required

Apply the fixes referenced in the Oracle Security Alert for August 2026 without delay.
Inventory all Oracle Agile PLM 9.3.6 deployments, including staging and disaster-recovery instances.
Restrict HTTP access to Agile PLM interfaces to trusted management networks and VPN users only.
Review Agile PLM audit logs for signs of prior unauthenticated access or account changes.

Patch Information

Oracle published the fix in the security alert cspuaug2026. Administrators should apply the patch identified in the Oracle Security Alert to Oracle Agile PLM 9.3.6 installations. Confirm the patch level after deployment and validate that the Security component version matches Oracle's expected release.

Workarounds

Place Oracle Agile PLM behind an authenticated reverse proxy or web application firewall that enforces strict access controls.
Block external network access to Agile PLM HTTP endpoints until the patch is applied.
Rotate service account credentials and administrator passwords used by Agile PLM after patching.

bash

# Example: restrict Agile PLM HTTP access at the perimeter
# Replace 10.0.0.0/24 with your trusted management subnet
iptables -A INPUT -p tcp --dport 7001 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7001 -j DROP