CVE-2026-71045: Oracle Agile PLM Auth Bypass Vulnerability

CVE-2026-71045 Overview

CVE-2026-71045 is a high-severity vulnerability in the Security component of Oracle Agile PLM, part of the Oracle Supply Chain product family. The flaw affects Oracle Agile PLM version 9.3.6 and can be exploited by an unauthenticated attacker with network access over HTTP. Successful exploitation requires user interaction from a victim other than the attacker, but results in full takeover of the Oracle Agile PLM instance. The vulnerability maps to [CWE-284: Improper Access Control] and impacts confidentiality, integrity, and availability.

Critical Impact
An unauthenticated attacker who convinces a user to interact with a crafted HTTP request can achieve complete takeover of Oracle Agile PLM 9.3.6.

Affected Products

Oracle Agile PLM 9.3.6
Oracle Supply Chain (Agile PLM component: Security)
Deployments exposing the Agile PLM web interface over HTTP

Discovery Timeline

2026-08-18 - CVE-2026-71045 published to NVD
2026-08-20 - Last updated in NVD database
August 2026 - Referenced in the Oracle Security Alert August 2026

Technical Details for CVE-2026-71045

Vulnerability Analysis

The vulnerability resides in the Security component of Oracle Agile PLM 9.3.6. It permits an unauthenticated remote attacker to compromise the application when a legitimate user is induced to interact with attacker-supplied content. Because the attack traverses HTTP and does not require prior privileges, the exploitation barrier is low for internet-exposed deployments.

Successful exploitation yields complete takeover of the Agile PLM instance, giving the attacker the ability to read, modify, and destroy product lifecycle data. Oracle Agile PLM commonly houses intellectual property including bills of materials, engineering change orders, and supplier records, so a compromise directly threatens supply chain confidentiality.

The scope is unchanged, meaning the impact is contained within the vulnerable Agile PLM security context, though that context governs all product data managed by the application.

Root Cause

The issue is classified under [CWE-284: Improper Access Control]. The Security component of Agile PLM does not correctly enforce authorization or trust boundaries on requests that involve user interaction, allowing an unauthenticated attacker to leverage a victim's session context to reach protected functionality.

Attack Vector

The attack is delivered over the network via HTTP. The attacker crafts a malicious link or request and induces an Agile PLM user to interact with it, typically through phishing or a watering-hole page. Once the user triggers the request, the flawed access control allows the attacker to perform privileged operations, culminating in takeover of the application.

No public proof-of-concept is currently listed, and the vulnerability is not present on the CISA Known Exploited Vulnerabilities catalog. Refer to the Oracle Security Alert August 2026 for authoritative technical detail.

Detection Methods for CVE-2026-71045

Indicators of Compromise

Unexpected administrative actions, user creation, or role changes inside Oracle Agile PLM audit logs
HTTP requests to Agile PLM endpoints originating from external referrers or unusual user-agents
Session activity from Agile PLM users immediately following clicks on external links or email attachments
Modification or export of bill-of-materials, change order, or supplier records outside of standard business workflows

Detection Strategies

Correlate web server access logs from the Agile PLM front-end with authenticated session events to identify request patterns that combine external referrers with sensitive operations
Monitor for anomalous HTTP POST activity to Agile PLM Security component URLs, particularly requests that yield state changes without prior authenticated navigation
Alert on Agile PLM administrator role assignments performed outside of an approved change window

Monitoring Recommendations

Forward Agile PLM application, web tier, and database audit logs to a centralized analytics platform for retention and correlation
Baseline typical user workflows in Agile PLM and flag deviations such as bulk data exports or off-hours edits
Track outbound traffic from Agile PLM hosts to detect data staging following a successful takeover

How to Mitigate CVE-2026-71045

Immediate Actions Required

Apply the fixes published in the Oracle Security Alert August 2026 to all Oracle Agile PLM 9.3.6 deployments
Restrict access to the Agile PLM web interface to trusted networks or VPN users while patching is scheduled
Rotate credentials and review recent administrative activity for any Agile PLM instance exposed to untrusted networks
Brief Agile PLM users on the user-interaction requirement and reinforce phishing awareness for engineering and supply chain teams

Patch Information

Oracle addressed the vulnerability in the August 2026 security alert cycle. Administrators should download and install the corresponding patch for Oracle Agile PLM 9.3.6 from My Oracle Support and follow the deployment sequence documented in the Oracle Security Alert August 2026.

Workarounds

Place the Agile PLM application behind a reverse proxy or web application firewall that enforces strict referrer, origin, and content-type checks on Security component endpoints
Enforce multi-factor authentication and short session lifetimes for Agile PLM users to reduce the value of a hijacked session
Segment Agile PLM servers from general user networks so that only approved application traffic can reach the HTTP interface
Disable or restrict Agile PLM features that are not required for business operations to reduce the exposed attack surface

bash

# Example: restrict access to the Oracle Agile PLM web tier at the network edge
# Replace the source ranges and interface names with values that match your environment
iptables -A INPUT -p tcp --dport 443 -s 10.10.0.0/16 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP