CVE-2026-83260

Oracle Agile PLM 9.3.6 contains a critical flaw (CVSS 9.1) in the Event Java PX (Process Extension) component that a high-privileged attacker with network access can exploit over the T3 or IIOP protocols to fully take over the Agile PLM server. Because the vulnerability has a scope change, a successful attack can also significantly impact products beyond Agile PLM itself, with high impact on confidentiality, integrity, and availability. Exploitation is described as easy once the attacker holds the required high privileges, which effectively turns any compromised admin account or trusted network foothold into complete server compromise. The affected population is enterprises running the on-premises Oracle Agile PLM 9.3.6 release, common in manufacturing and product-development environments. No public proof-of-concept exists and the flaw is not in the CISA Known Exploited Vulnerabilities catalog, so there is no evidence of in-the-wild exploitation at this time.

What to do: Apply the corresponding Oracle Critical Patch Update to Agile PLM 9.3.6 as soon as it is available for this CVE. In the meantime, restrict T3 and IIOP listener access at the firewall to trusted admin clients only, since the flaw requires high privileges — audit privileged Agile/WebLogic accounts and rotate credentials that may be exposed. Review deployed Event Java PX extensions and server logs for unauthorized changes or suspicious T3/IIOP activity, and accelerate planning to migrate off the aging 9.3.6 line toward Oracle Fusion Cloud PLM.