CVE-2026-87257: Oracle Agile PLM Auth Bypass Vulnerability

CVE-2026-87257 Overview

CVE-2026-87257 is an improper access control vulnerability [CWE-284] in the Oracle Agile PLM product of Oracle Supply Chain. The flaw resides in the Software Development Kit (SDK) component of Oracle Agile PLM version 9.3.6. A low-privileged attacker with network access over HTTP can exploit the weakness to gain unauthorized read access to critical data within Oracle Agile PLM. The vulnerability carries a scope change, meaning exploitation may impact resources beyond the vulnerable component itself. Oracle addressed the issue in the Oracle Security Alert CSPUSEP2026.

Critical Impact
Authenticated attackers can reach confidential Oracle Agile PLM data over the network and pivot to other in-scope resources.

Affected Products

Oracle Agile PLM 9.3.6
Oracle Supply Chain (Agile PLM SDK component)
Deployments exposing the Agile PLM SDK over HTTP

Discovery Timeline

2026-09-15 - CVE-2026-87257 published to the National Vulnerability Database (NVD)
2026-09-17 - CVE record last modified in NVD

Technical Details for CVE-2026-87257

Vulnerability Analysis

The vulnerability is classified as Improper Access Control [CWE-284] in the Oracle Agile PLM SDK. The SDK exposes functionality over HTTP that does not sufficiently enforce authorization checks against the requesting principal. An attacker who already holds low-level credentials to the Agile PLM environment can invoke SDK operations that were intended for higher-privileged users or adjacent components. Successful exploitation results in unauthorized access to confidential data or full disclosure of all data accessible to Oracle Agile PLM. Integrity and availability are not directly impacted, but the scope change indicates that data outside the immediate security authority of Agile PLM may be exposed.

Root Cause

The root cause is missing or insufficient access control enforcement inside the Oracle Agile PLM SDK component. Requests that should be gated by authorization checks are handled without validating that the authenticated user is entitled to the requested resource. Because the SDK operates across trust boundaries, the missing check permits data belonging to other security scopes to be returned.

Attack Vector

Exploitation requires network access to the Agile PLM SDK endpoint over HTTP and valid low-privileged credentials. No user interaction is required, and the attack complexity is low. An attacker crafts SDK requests targeting protected resources or operations and receives confidential data in the response. Because the scope changes on successful exploitation, data controlled by additional Oracle products integrated with Agile PLM may also be exposed.

No public proof-of-concept exploit is currently available. See the Oracle Security Alert CSPUSEP2026 for vendor-supplied technical details.

Detection Methods for CVE-2026-87257

Indicators of Compromise

Authenticated HTTP requests from low-privileged accounts to Agile PLM SDK endpoints returning large or unusual data volumes.
Access patterns where a single Agile PLM user account enumerates SDK resources spanning multiple business units or product lines.
Anomalous outbound data transfer from Agile PLM application servers following SDK access.

Detection Strategies

Enable and review Oracle Agile PLM audit logs for SDK operations invoked by accounts that should not have access to the targeted objects.
Correlate web server access logs with Agile PLM role assignments to identify authorization decisions that deviate from role scope.
Baseline normal SDK usage per account and alert on statistical outliers in request frequency, response size, or accessed object types.

Monitoring Recommendations

Forward Agile PLM application, web tier, and database audit logs to a centralized analytics platform for retention and correlation.
Monitor authentication events for low-privileged Agile PLM accounts, particularly service or integration accounts with network reachability to the SDK.
Alert on repeated HTTP 200 responses to SDK endpoints from accounts that historically produced HTTP 403 responses.

How to Mitigate CVE-2026-87257

Immediate Actions Required

Apply the fix documented in the Oracle Security Alert CSPUSEP2026 to all Oracle Agile PLM 9.3.6 deployments.
Inventory every Agile PLM instance and confirm which are reachable over HTTP from user or partner networks.
Rotate credentials for low-privileged Agile PLM accounts, especially integration and service accounts, after patching.

Patch Information

Oracle released the fix as part of the Oracle Security Alert CSPUSEP2026. Administrators should follow Oracle's patch installation guidance for Agile PLM 9.3.6 and validate the patch level after deployment. Refer to the Oracle Security Alert CSPUSEP2026 for the authoritative patch bundle and prerequisites.

Workarounds

Restrict network reachability to the Agile PLM SDK endpoints using firewalls, reverse proxies, or web application firewall (WAF) rules until patching is complete.
Enforce least privilege on Agile PLM accounts and disable unused low-privileged accounts that could be leveraged for exploitation.
Require authenticated SDK access to traverse a VPN or zero-trust network access broker to reduce exposure of the HTTP surface.

bash

# Example: block external access to the Agile PLM SDK HTTP endpoint
# Replace <AGILE_PLM_HOST> and <SDK_PORT> with your deployment values
iptables -A INPUT -p tcp --dport <SDK_PORT> -s 0.0.0.0/0 -j DROP
iptables -A INPUT -p tcp --dport <SDK_PORT> -s 10.0.0.0/8 -j ACCEPT