CVE-2026-71042: Oracle Agile PLM DOS Vulnerability

CVE-2026-71042 Overview

CVE-2026-71042 is a broken access control vulnerability [CWE-284] in the Oracle Agile PLM product of Oracle Supply Chain. The flaw resides in the PGC / Excel Plugin component of Oracle Agile PLM version 9.3.6. A low-privileged attacker with HTTP network access can exploit the vulnerability without user interaction. Successful exploitation allows unauthorized creation, deletion, or modification of critical Oracle Agile PLM data. Attackers can also trigger a hang or repeatable crash, resulting in a complete denial of service of the Oracle Agile PLM instance.

Critical Impact
Authenticated attackers over the network can tamper with all Oracle Agile PLM accessible data and cause a full denial of service against the product lifecycle management platform.

Affected Products

Oracle Agile PLM 9.3.6
Oracle Supply Chain — Agile PLM PGC component
Oracle Agile PLM Excel Plugin

Discovery Timeline

2026-08-18 - CVE-2026-71042 published to NVD
2026-08-20 - Last updated in NVD database
Oracle Security Alert CSPUAUG2026 - Oracle publishes advisory and patch guidance

Technical Details for CVE-2026-71042

Vulnerability Analysis

The vulnerability affects the PGC / Excel Plugin component of Oracle Agile PLM 9.3.6. The flaw is classified under CWE-284 (Improper Access Control), indicating that the component fails to enforce sufficient authorization checks on requests reaching it over HTTP. An attacker holding any authenticated session can leverage these gaps to invoke privileged operations against Agile PLM data. Because the plugin handles product lifecycle records, exploitation can affect the integrity of engineering change orders, bills of materials, and other supply chain artifacts.

The issue provides no path to data disclosure. Instead, impact is limited to integrity and availability, meaning the attacker manipulates or destroys data and can force the service into a crash state. The CVSS vector indicates a scope-unchanged, network-reachable weakness requiring low privileges and no user interaction, which favors both opportunistic and targeted abuse by insider or compromised low-tier accounts.

Root Cause

The root cause is improper access control within the PGC / Excel Plugin interface. The component accepts requests and performs privileged actions without verifying that the caller has the authorization required to create, modify, or delete the targeted objects. Oracle has not published component-level source details, and the vendor advisory (Oracle Security Alert CSPUAUG2026) is the authoritative technical reference.

Attack Vector

Exploitation occurs over HTTP against the Oracle Agile PLM server. The attacker must hold a valid low-privileged application account. From this position the attacker issues crafted requests to the PGC / Excel Plugin endpoints to modify or destroy records, or to place the service into a repeatable crash condition producing complete DoS. No user interaction is required and attack complexity is low.

No public proof-of-concept exploit code is available for CVE-2026-71042. Refer to the Oracle Security Alert CSPUAUG2026 for vendor-supplied technical details.

Detection Methods for CVE-2026-71042

Indicators of Compromise

Unexpected creation, modification, or deletion of Agile PLM objects such as items, change orders, or BOM records by low-privileged accounts.
Repeated crashes or unresponsive states of the Agile PLM application server correlated with requests to PGC or Excel Plugin endpoints.
Anomalous HTTP requests to Agile PLM Excel Plugin URLs originating from atypical user agents or IP ranges.

Detection Strategies

Audit Agile PLM application logs for object modification events performed by accounts that should not have write access to the affected objects.
Correlate web server access logs for PGC / Excel Plugin endpoints against user role assignments to spot authorization mismatches.
Alert on abnormal spikes in HTTP 5xx responses or application restarts on Agile PLM hosts, which may indicate DoS attempts.

Monitoring Recommendations

Forward Agile PLM audit, application, and web server logs into a centralized SIEM for correlation across authentication and data-change events.
Baseline normal Excel Plugin usage per user and flag deviations in request volume or endpoint access patterns.
Monitor privileged data objects for out-of-cycle changes and route them through change management review.

How to Mitigate CVE-2026-71042

Immediate Actions Required

Apply the patches referenced in the Oracle Security Alert CSPUAUG2026 to all Oracle Agile PLM 9.3.6 deployments.
Restrict network exposure of the Agile PLM application server so that HTTP access is limited to trusted internal networks and VPN segments.
Review and reduce the number of low-privileged accounts with access to the PGC / Excel Plugin interface.

Patch Information

Oracle addressed CVE-2026-71042 in the security patch published under Oracle Security Alert CSPUAUG2026. Administrators running Oracle Agile PLM 9.3.6 should apply the Oracle-supplied patch bundle for this alert. No official workaround is provided in the advisory; patching is the vendor-recommended remediation.

Workarounds

Place the Agile PLM web tier behind a reverse proxy or WAF and enforce strict allow-lists for PGC and Excel Plugin URL paths until patches are applied.
Temporarily disable or restrict the Excel Plugin functionality for users who do not require it.
Enforce multi-factor authentication and short session lifetimes for all Agile PLM accounts to reduce the value of stolen low-privileged credentials.

bash

# Example: restrict access to Agile PLM Excel Plugin endpoints at the reverse proxy
# (Apache httpd configuration snippet)
<Location /Agile/PGC>
    Require ip 10.0.0.0/8
    Require ip 192.168.0.0/16
</Location>

<Location /Agile/ExcelPlugin>
    Require ip 10.0.0.0/8
    Require ip 192.168.0.0/16
</Location>