PT-2026-3690 · Oracle · Oracle Agile Plm

Published 2026-01-20 · Updated 2026-01-21 · CVE-2026-21940

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Oracle Agile PLM version 9.3.6

Description An easily exploitable issue exists in the Oracle Agile PLM product within Oracle Supply Chain, specifically in the User and User Group component. An unauthenticated attacker with network access via HTTP can compromise the system. Successful exploitation may lead to unauthorized access to critical data or complete access to all Oracle Agile PLM accessible data.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-21940

Affected Products

Oracle Agile Plm

References · 4

• https://osv.dev/vulnerability/CVE-2026-21940 · Vendor Advisory
• https://oracle.com/security-alerts/cpujan2026.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-21940 · Security Note
• https://twitter.com/CVEnew/status/2013783016729125310 · Twitter Post