CVE-2026-87266: Oracle Agile PLM Auth Bypass Vulnerability

CVE-2026-87266 Overview

CVE-2026-87266 is a network-exploitable vulnerability in the Oracle Agile PLM product of Oracle Supply Chain. The flaw resides in the Application Server component of Oracle Agile PLM version 9.3.6. An unauthenticated remote attacker with HTTP access can compromise the application without user interaction. Successful exploitation grants unauthorized access to all data accessible through Oracle Agile PLM and can cause a partial denial of service.

Critical Impact
Unauthenticated attackers with network access to the Application Server can read all data accessible to Oracle Agile PLM and degrade service availability.

Affected Products

Oracle Agile PLM 9.3.6
Oracle Supply Chain — Application Server component
Deployments exposing Oracle Agile PLM over HTTP

Discovery Timeline

2026-09-15 - CVE-2026-87266 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-87266

Vulnerability Analysis

The flaw affects the Application Server component of Oracle Agile PLM 9.3.6. Oracle characterizes the issue as easily exploitable over HTTP, requiring no authentication and no user interaction. Impact is concentrated on confidentiality, with high exposure of data accessible to the application, and a partial availability impact on the service itself. Integrity is not affected according to the published vector.

With an EPSS score of 0.36% (29.6 percentile), automated mass exploitation is not currently predicted. However, Oracle Agile PLM is a Product Lifecycle Management system that typically stores intellectual property, bills of materials, and engineering change data, making targeted exploitation attractive to industrial espionage actors.

Root Cause

Oracle has not published detailed technical root-cause information beyond the Security Alert. The advisory scope indicates a defect in the Application Server component that permits an unauthenticated network client to reach a sensitive code path and retrieve data it should not be authorized to access. See the Oracle Security Alert CSPUSEP2026 for the authoritative advisory.

Attack Vector

Exploitation requires only network access to the HTTP interface of the Oracle Agile PLM Application Server. No credentials or user interaction are required, and attack complexity is low. An attacker crafts HTTP requests against the vulnerable endpoint to extract data or trigger conditions that partially degrade availability. Instances directly reachable from untrusted networks are at greatest risk.

Because verified proof-of-concept code is not publicly available, refer to the Oracle advisory for technical details rather than synthetic exploit examples.

Detection Methods for CVE-2026-87266

Indicators of Compromise

Unauthenticated HTTP requests to Oracle Agile PLM endpoints originating from unexpected external IP addresses.
Anomalous volumes of successful HTTP 200 responses returning large payloads from Agile PLM Application Server logs.
Application Server errors or worker-thread saturation consistent with partial denial-of-service behavior.

Detection Strategies

Review Application Server access logs for request patterns targeting Agile PLM URLs without prior authenticated session tokens.
Correlate outbound data transfer volumes from Agile PLM hosts against historical baselines to identify bulk data extraction.
Deploy web application firewall (WAF) rules that alert on unauthenticated access to sensitive Agile PLM endpoints.

Monitoring Recommendations

Forward Application Server, reverse proxy, and WAF logs to a centralized analytics platform for continuous review.
Alert on repeated HTTP requests from a single source that enumerate Agile PLM resources.
Monitor host-level indicators such as CPU spikes, thread pool exhaustion, and JVM garbage collection anomalies on Agile PLM servers.

How to Mitigate CVE-2026-87266

Immediate Actions Required

Apply the fixes described in the Oracle Security Alert CSPUSEP2026 to all Oracle Agile PLM 9.3.6 deployments.
Restrict network access to the Agile PLM Application Server to trusted internal networks and named administrative IPs.
Audit Agile PLM access logs for signs of unauthenticated data retrieval prior to patch application.

Patch Information

Oracle addressed CVE-2026-87266 in Security Alert CSPUSEP2026. Administrators running Oracle Agile PLM 9.3.6 should consult the advisory for the applicable patch bundle and installation instructions. Apply the patch during the next available maintenance window and validate that the Application Server restarts cleanly.

Workarounds

Place Oracle Agile PLM behind an authenticating reverse proxy or VPN gateway to block unauthenticated HTTP access.
Enforce network segmentation so that only sanctioned application and integration hosts can reach the Application Server.
Use WAF rules to reject requests to sensitive Agile PLM endpoints that do not carry a valid authenticated session.

bash

# Example: restrict Agile PLM Application Server access with iptables
iptables -A INPUT -p tcp --dport 7001 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 7001 -j DROP