CVE-2026-87253: Oracle Agile PLM Auth Bypass Vulnerability

CVE-2026-87253 Overview

CVE-2026-87253 is a vulnerability in the Oracle Agile PLM Web Client component that affects version 9.3.6. An unauthenticated attacker with network access via HTTP can compromise Oracle Agile PLM by targeting an authenticated user. Successful exploitation requires user interaction and results in a scope change, meaning attacks can significantly impact resources beyond the vulnerable component. Impact includes unauthorized modification, insertion, or deletion of Agile PLM data, along with unauthorized read access to a subset of accessible data. The vulnerability is classified under [CWE-284] Improper Access Control.

Critical Impact
Unauthenticated attackers can trick authenticated Agile PLM users into triggering requests that modify product lifecycle data and expose information across trust boundaries.

Affected Products

Oracle Supply Chain — Oracle Agile PLM 9.3.6
Oracle Agile PLM Web Client component
Downstream products integrated with Oracle Agile PLM (scope change)

Discovery Timeline

2026-09-15 - CVE-2026-87253 published to the National Vulnerability Database
2026-09-15 - Oracle Security Alert September 2026 released
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-87253

Vulnerability Analysis

CVE-2026-87253 resides in the Web Client component of Oracle Agile PLM 9.3.6, Oracle's Product Lifecycle Management platform for engineering and supply chain data. The flaw allows a remote, unauthenticated attacker to compromise the application by convincing an authenticated user to interact with attacker-controlled content, such as a crafted URL or web page.

The scope change property indicates the exploit reaches beyond the Agile PLM security boundary. This behavior is characteristic of client-side injection issues where a browser executes attacker-supplied content within the trust context of the authenticated session. Successful exploitation grants limited read access and limited write access, enabling manipulation of PLM records such as bills of materials, change orders, or documents.

Root Cause

The underlying weakness is improper access control [CWE-284] in the Web Client. The application does not sufficiently restrict actions performed on behalf of an authenticated user when those actions are triggered from an untrusted origin. Combined with insufficient validation of user-supplied content rendered to the browser, this permits an attacker to induce data-modifying and data-reading operations without holding credentials.

Attack Vector

Exploitation occurs over the network via HTTP against a targeted Agile PLM deployment. The attacker crafts a malicious link or web page and delivers it to an authenticated Agile PLM user through phishing or watering-hole techniques. When the victim interacts with the payload, their browser issues requests to the Web Client that execute in the victim's authenticated session. No credentials, prior access, or elevated privileges are required by the attacker. Refer to the Oracle Security Alert September 2026 for vendor technical detail.

Detection Methods for CVE-2026-87253

Indicators of Compromise

Unexpected modifications to Agile PLM objects such as change orders, items, or attachments performed by legitimate user accounts outside normal working patterns.
HTTP referrer headers on Agile PLM Web Client requests pointing to unknown external domains.
Web Client requests containing encoded script payloads, unusual query parameters, or long URL-encoded strings in POST bodies.

Detection Strategies

Inspect Agile PLM Web Client access logs for authenticated actions originating from off-site referrers or immediately following navigation from external URLs.
Correlate PLM audit trail entries with proxy and email gateway logs to identify user interaction with suspicious links preceding data changes.
Deploy web application firewall (WAF) signatures targeting reflected script payloads and unexpected parameter structures against the Web Client.

Monitoring Recommendations

Enable and centralize Agile PLM audit logs, then forward them to a SIEM for correlation with endpoint and identity telemetry.
Alert on bulk or off-hours modifications to controlled PLM records by any single user session.
Monitor egress traffic from workstations that access Agile PLM for connections to newly registered or low-reputation domains.

How to Mitigate CVE-2026-87253

Immediate Actions Required

Apply the fixes documented in the Oracle Security Alert September 2026 to all Agile PLM 9.3.6 instances.
Restrict Web Client access to trusted internal networks or through a VPN until patching is complete.
Notify Agile PLM users of the phishing risk and instruct them to avoid clicking links to the application from external email or chat.

Patch Information

Oracle addressed CVE-2026-87253 in the Oracle Security Alert September 2026. Administrators should review the alert, identify the applicable patch for Oracle Agile PLM 9.3.6, and schedule installation according to Oracle's guidance. Confirm patch application by verifying the deployed component version after the maintenance window.

Workarounds

Enforce short session timeouts and require re-authentication for sensitive PLM operations to reduce the window for session abuse.
Deploy a WAF in front of the Agile PLM Web Client with rules that block reflected script content and validate the Referer and Origin headers on state-changing requests.
Segment Agile PLM from general user browsing by using a dedicated browser profile or jump host for PLM access.

bash

# Example WAF rule concept for state-changing Agile PLM requests
# Block POST requests to the Web Client when Origin header is missing
# or does not match the approved Agile PLM hostname
SecRule REQUEST_METHOD "@streq POST" \
  "chain,deny,status:403,id:1008725,msg:'Agile PLM off-origin request blocked'"
  SecRule REQUEST_HEADERS:Origin "!@rx ^https://agileplm\.example\.com$"