CVE-2026-87258 Overview
CVE-2026-87258 is a high-severity vulnerability in the Oracle Agile PLM product of Oracle Supply Chain. The flaw resides in the Folders, Files & Attachments component of Oracle Agile PLM version 9.3.6. A low-privileged attacker with network access via HTTP can exploit the vulnerability, though successful exploitation requires interaction from a user other than the attacker. The weakness is categorized under CWE-284: Improper Access Control. Exploitation results in unauthorized access to critical Oracle Agile PLM data and unauthorized modification of a subset of that data. The scope changes when the vulnerability is triggered, meaning impact can extend beyond Oracle Agile PLM to additional products.
Critical Impact
Attackers can obtain complete read access to Oracle Agile PLM data and modify a subset of records, with potential impact extending to adjacent products due to scope change.
Affected Products
- Oracle Agile PLM 9.3.6 (Oracle Supply Chain)
- Component: Folders, Files & Attachments
- Products within the affected trust boundary due to scope change
Discovery Timeline
- 2026-09-15 - CVE-2026-87258 published to NVD
- 2026-09-17 - Last updated in NVD database
- Oracle security advisory published as Oracle Security Alert CSPUSEP2026
Technical Details for CVE-2026-87258
Vulnerability Analysis
The vulnerability affects the Folders, Files & Attachments component of Oracle Agile PLM 9.3.6. An authenticated attacker holding low privileges can send crafted HTTP requests to the application. Successful exploitation requires a separate user to interact with attacker-supplied content, indicating a client-side interaction pattern such as opening a malicious attachment or following a crafted link within the PLM interface.
The scope changes upon exploitation, meaning the vulnerable component's actions affect resources managed by a different security authority. This behavior allows the attack to reach data and functionality outside the immediate Oracle Agile PLM boundary. The result is unauthorized disclosure of all PLM-accessible data and partial write access to that data. Integrity impact is limited, and availability is not affected.
Root Cause
Oracle classifies the underlying weakness as improper access control [CWE-284]. The Folders, Files & Attachments component does not sufficiently enforce authorization boundaries when processing user-supplied content, allowing a low-privileged actor to influence resources that should require elevated trust once another user interacts with the injected content.
Attack Vector
The attack originates over the network via HTTP. An attacker authenticates with low privileges, stages malicious content within the Folders, Files & Attachments feature, and waits for a targeted user to interact with it. Interaction triggers the access control bypass, exposing critical data and permitting modification of selected records. Because scope changes, the effective blast radius is not restricted to the PLM application itself.
No verified public exploit code or proof-of-concept is available. Refer to the Oracle Security Alert CSPUSEP2026 for vendor-supplied technical guidance.
Detection Methods for CVE-2026-87258
Indicators of Compromise
- Unexpected uploads or modifications within the Oracle Agile PLM Folders, Files & Attachments component originating from low-privileged accounts.
- HTTP requests to Agile PLM endpoints containing unusual attachment payloads or references to external hosts.
- Access patterns showing a single low-privileged user staging content viewed shortly afterward by higher-privileged users.
Detection Strategies
- Review Oracle Agile PLM audit logs for anomalous attachment creation, download, or modification events tied to low-privileged roles.
- Correlate PLM web server access logs with authentication logs to identify privilege boundary crossings after attachment interactions.
- Alert on scope-crossing activity where PLM actions trigger requests to systems outside the expected PLM integration path.
Monitoring Recommendations
- Enable detailed audit logging for the Folders, Files & Attachments component and forward events to a centralized analytics platform.
- Baseline normal attachment workflows to detect deviations in volume, file types, or user roles.
- Monitor outbound network activity from Oracle Agile PLM hosts for unexpected connections that may indicate scope-changed exploitation.
How to Mitigate CVE-2026-87258
Immediate Actions Required
- Apply the fixes documented in Oracle Security Alert CSPUSEP2026 to affected Oracle Agile PLM 9.3.6 deployments.
- Restrict network access to the Oracle Agile PLM web interface to trusted corporate networks and VPN users.
- Audit user accounts and enforce least-privilege role assignments in Agile PLM.
- Notify PLM users to avoid opening unexpected attachments or links inside the application until patches are applied.
Patch Information
Oracle addressed this vulnerability in the Oracle Security Alert CSPUSEP2026 advisory. Administrators should review the advisory and apply the associated patches to Oracle Agile PLM 9.3.6. See the Oracle Security Alert CSPUSEP2026 for patch numbers and deployment instructions.
Workarounds
- Temporarily restrict use of the Folders, Files & Attachments component to a limited set of trusted roles until patching completes.
- Place a web application firewall (WAF) in front of the Oracle Agile PLM interface to filter suspicious HTTP requests targeting the attachment component.
- Increase monitoring and logging on Agile PLM during the exposure window, and require secondary review for attachments uploaded by low-privileged accounts.
# Example: restrict access to Agile PLM web interface at the network layer
# Allow only trusted subnets to reach the Agile PLM application server
iptables -A INPUT -p tcp --dport 7001 -s 10.10.0.0/16 -j ACCEPT
iptables -A INPUT -p tcp --dport 7001 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
