CVE-2026-21940

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: User and User Group)

High · published January 20, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
33.7
In the wild
Unconfirmed
What it is

🚨 An unauthenticated attacker can exploit this vulnerability with just network access! The Oracle Agile PLM software is at risk and it’s critical to act now! 🔥 Think of Oracle Agile PLM as a vault containing valuable treasure, but the vault has a flimsy lock that anyone can pick with the right tools. This vulnerability is like leaving the front door wide open, allowing anyone passing by to stroll in and snatch away the valuables inside. If exploited, an attacker could gain unauthorized access to sensitive data, potentially leading to complete control over all information stored in Oracle Agile PLM. This could mean exposing confidential business documents, customer data, and proprietary information, which could be absolutely devastating for your organization's integrity and trustworthiness.

Put simply

Think of Oracle Agile PLM as a vault containing valuable treasure, but the vault has a flimsy lock that anyone can pick with the right tools. This vulnerability is like leaving the front door wide open, allowing anyone passing by to stroll in and snatch away the valuables inside. This vulnerability allows unauthenticated users to compromise Oracle Agile PLM due to insufficient access controls. This means that a simple HTTP request can bypass security measures and reveal critical data.

What to do

If exploited, an attacker could gain unauthorized access to sensitive data, potentially leading to complete control over all information stored in Oracle Agile PLM. This could mean exposing confidential business documents, customer data, and proprietary information, which could be absolutely devastating for your organization's integrity and trustworthiness. To mitigate this risk, upgrade Oracle Agile PLM to version 9.3.7 and enforce stricter access controls immediately. Ensure that firewalls are configured to limit network access to the application and regularly audit user permissions to prevent unauthorized access. You've got this! Follow these steps and you'll secure your Oracle Agile PLM system in no time! 🛡️

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00406 · 33.7th percentile
Published
2026-01-20T21:56Z
EPSS history
Timeline
  • 20 JAN 21:56Z
    Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: User and User Group)
    cvelistv5