CVE-2026-87256: Oracle Agile PLM Auth Bypass Vulnerability

CVE-2026-87256 Overview

CVE-2026-87256 is an access control vulnerability [CWE-284] affecting the Application Server component of Oracle Agile PLM, part of the Oracle Supply Chain product family. The flaw exists in supported version 9.3.6 and allows a low-privileged attacker with network access over HTTP to compromise the application. The vulnerability produces a scope change, meaning successful exploitation impacts resources beyond Oracle Agile PLM itself. Successful attacks result in unauthorized access to critical data or complete read access to all data accessible through Oracle Agile PLM.

Critical Impact
A low-privileged authenticated attacker can gain unauthorized read access to all Oracle Agile PLM accessible data through network-based HTTP requests, with impact extending beyond the vulnerable component.

Affected Products

Oracle Agile PLM (Oracle Supply Chain)
Component: Application Server
Version: 9.3.6

Discovery Timeline

2026-09-15 - CVE-2026-87256 published to NVD
2026-09-17 - Last updated in NVD database
Referenced in the Oracle Security Alert September 2026

Technical Details for CVE-2026-87256

Vulnerability Analysis

The vulnerability resides in the Application Server component of Oracle Agile PLM 9.3.6. It is categorized under [CWE-284] Improper Access Control, indicating that the application fails to properly enforce authorization boundaries on protected resources. An authenticated user with only low-level privileges can leverage HTTP requests to read data they should not be permitted to access.

The scope change indicator means the vulnerable component and the impacted component are not the same. Exploitation of the Application Server flaw affects data and functionality controlled by security authorities beyond Oracle Agile PLM, expanding blast radius across integrated supply chain systems.

Root Cause

The root cause is improper access control within the Application Server component. Authorization checks are either missing or insufficient on HTTP-accessible endpoints, allowing low-privileged accounts to retrieve data outside their assigned permissions. Oracle has not published detailed technical internals in the public advisory.

Attack Vector

Exploitation requires network access to the Oracle Agile PLM HTTP interface and valid low-privileged credentials. No user interaction is required. The attack complexity is low, meaning no specialized conditions or timing dependencies exist. An attacker sends crafted HTTP requests to Application Server endpoints and receives confidential data in response.

No public proof-of-concept exploit is available at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Technical details are limited to the vendor advisory. Refer to the Oracle Security Alert September 2026 for authoritative guidance.

Detection Methods for CVE-2026-87256

Indicators of Compromise

Unusual volumes of HTTP requests from low-privileged Oracle Agile PLM accounts targeting endpoints outside their normal usage pattern.
Successful HTTP 200 responses to Application Server resources that historically return 401 or 403 for the requesting account.
Authentication events from Oracle Agile PLM service accounts followed by large data reads or exports.

Detection Strategies

Baseline normal per-role access patterns for Oracle Agile PLM endpoints and alert on deviations, especially data-retrieval endpoints accessed by low-tier roles.
Correlate Oracle Agile PLM application logs with network traffic to identify enumeration behavior against Application Server URIs.
Inspect HTTP request logs for parameter tampering or repeated access attempts to object identifiers that do not belong to the authenticated user.

Monitoring Recommendations

Enable detailed audit logging on the Oracle Agile PLM Application Server and forward logs to a centralized analytics platform.
Monitor authentication events for low-privileged accounts followed by cross-boundary data access.
Track outbound data volumes from Oracle Agile PLM servers to detect bulk data exfiltration attempts.

How to Mitigate CVE-2026-87256

Immediate Actions Required

Apply the fixes published in the Oracle Security Alert September 2026 to all instances of Oracle Agile PLM 9.3.6.
Inventory all Oracle Agile PLM deployments and confirm patch status against the Oracle advisory.
Review low-privileged account activity for signs of unauthorized data access preceding patch deployment.

Patch Information

Oracle addressed CVE-2026-87256 as part of the September 2026 Security Alert cycle. Administrators should consult the Oracle Security Alert September 2026 for the specific patch bundle, prerequisites, and installation instructions applicable to Oracle Agile PLM 9.3.6.

Workarounds

Restrict network access to the Oracle Agile PLM Application Server to trusted management networks and authorized user segments only.
Review and tighten role assignments to eliminate unnecessary low-privileged accounts with HTTP access.
Place a reverse proxy or web application firewall in front of Oracle Agile PLM to enforce authentication scoping and rate limits on suspicious request patterns.
Rotate credentials for accounts that may have been exposed prior to patching.