Agile Product Lifecycle Management vulnerabilities

31 known vulnerabilities in Agile Product Lifecycle Management from Oracle. 31 are rated high or critical, and 6 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.2 High severity

  Oracle Agile PLM: Improper Access Control

  CVE-2026-87266Sep 15, 2026Oracle

  Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Application Server). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise O

• 7.6 High severity

  Oracle Agile PLM: Improper Access Control

  CVE-2026-87258Sep 15, 2026Oracle

  Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Folders, Files & Attachments). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to com

• 7.7 High severity

  Oracle Agile PLM: Improper Access Control

  CVE-2026-87257Sep 15, 2026Oracle

  Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: SDK). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM.

• 7.7 High severity

  Oracle Agile PLM: Improper Access Control

  CVE-2026-87256Sep 15, 2026Oracle

  Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Application Server). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Or

• 7.5 High severity

  Oracle Agile PLM: Improper Access Control

  CVE-2026-87254Sep 15, 2026Oracle

  Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Folders, Files & Attachments). The supported version that is affected is 9.3.6. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to c

• 8.8 High severity

  Oracle Agile PLM: Improper Access Control

  CVE-2026-71046Aug 18, 2026Oracle

  Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Security). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Agile PLM

• 8.8 High severity

  Oracle Agile PLM: Improper Access Control

  CVE-2026-71045Aug 18, 2026Oracle

  Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Security). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agil

• 8.8 High severity

  Oracle Agile PLM: Improper Access Control

  CVE-2026-71044Aug 18, 2026Oracle

  Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Export). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile P

• 7.5 High severity

  Oracle Agile PLM: Improper Access Control

  CVE-2026-71043Aug 18, 2026Oracle

  Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Security). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agil

• 8.1 High severity

  Oracle Agile PLM: Improper Access Control

  CVE-2026-71042Aug 18, 2026Oracle

  Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: PGC / Excel Plugin). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Or

• 7.0 High severity

  Oracle Agile PLM: Improper Access Control

  CVE-2026-71041Aug 18, 2026Oracle

  Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Gantt Chart). The supported version that is affected is 9.3.6. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Agil

• 9.8 Critical severity

  Oracle Agile PLM: Improper Access Control

  CVE-2026-71040Aug 18, 2026Oracle

  Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Security). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agil

• 8.8 High severity

  Oracle Agile PLM: Improper Access Control

  CVE-2026-71039Aug 18, 2026Oracle

  Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Application Server). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Or

• 7.4 High severity

  Oracle Agile PLM: Improper Access Control

  CVE-2026-61173Jul 21, 2026Oracle

  Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Security). The supported version that is affected is 9.3.6. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Ag

• 7.5 High severity

  Oracle Agile PLM: Improper Access Control

  CVE-2026-61172Jul 21, 2026Oracle

  Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Security). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agil

• 9.1 Critical severity

  Oracle Agile PLM: Improper Access Control

  CVE-2026-61171Jul 21, 2026Oracle

  Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Security). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agil

• 8.1 High severity

  Oracle Agile PLM: Improper Access Control

  CVE-2026-61170Jul 21, 2026Oracle

  Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Security). The supported version that is affected is 9.3.6. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Ag

• 8.8 High severity

  Oracle Agile PLM: Improper Privilege Management

  CVE-2026-61168Jul 21, 2026Oracle

  Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Security). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile

• 9.8 Critical severity

  Oracle Agile PLM: Improper Access Control

  CVE-2026-61167Jul 21, 2026Oracle

  Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Security). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agil

• 8.8 High severity

  Oracle Agile PLM: Improper Access Control

  CVE-2026-61166Jul 21, 2026Oracle

  Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: User and User Group). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise O

• 9.8 Critical severity

  Oracle Agile PLM: Improper Authentication

  CVE-2026-46859Jun 17, 2026Oracle

  Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Security). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agil

• 7.5 High severity

  Oracle Agile PLM Framework: Incorrect Authorization

  CVE-2025-21565Jan 21, 2025Oracle

  Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Install). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Or

• 8.1 High severity

  Oracle Agile PLM Framework: Incorrect Permission Assignment for Critical Resource

  CVE-2025-21564Jan 21, 2025Oracle

  Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Agile Integration Services). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTT

• 9.9 Critical severity

  Oracle Agile PLM Framework: Incorrect Authorization

  CVE-2025-21556Jan 21, 2025Oracle

  Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Agile Integration Services). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTT

• 7.5 High severity

  Oracle Agile Product Lifecycle Management (PLM) Incorrect Authorization Exploited

  CVE-2024-21287Nov 18, 2024OracleEPSS 1.72%

  Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Software Development Kit, Process Extension). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with netw

• 8.8 High severity

  Oracle Agile Product Lifecycle Management (PLM) Deserialization Exploited

  CVE-2024-20953Feb 17, 2024OracleEPSS 3.93%

  Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Export). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile P

• 8.6 High severity

  Apache Tomcat: Improper Resource Shutdown or Release

  CVE-2022-25762May 13, 2022ApacheEPSS 8.4%

  If a web application sends a WebSocket message concurrently with the WebSocket connection closing when running on Apache Tomcat 8.5.0 to 8.5.75 or Apache Tomcat 9.0.0.M1 to 9.0.20, it is possible that the application will continue to use the socket after it ha

• 9.8 Critical severity

  Apache Tomcat Improper Privilege Management Exploited

  CVE-2020-1938Feb 24, 2020ApacheEPSS 99.3%

  When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attac

• 9.8 Critical severity

  Oracle WebLogic Server, Injection Exploited

  CVE-2019-2725Apr 26, 2019OracleEPSS 100%

  Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network ac

• 8.1 High severity

  Apache Tomcat Remote Code Execution Exploited

  CVE-2017-12617Oct 4, 2017ApacheEPSS 100%

  When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file

• 9.8 Critical severity

  Apache Tomcat Remote Code Execution Exploited

  CVE-2016-8735Apr 6, 2017ApacheEPSS 90.3%

  Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this list