CVE-2026-87266

Executive Summary

CVE-2026-87266 is an easily exploitable vulnerability in the Application Server component of Oracle Agile PLM, affecting supported version 9.3.6. An unauthenticated attacker with network access via HTTP can exploit the flaw to gain unauthorized access to critical data or complete access to all Oracle Agile PLM accessible data, and to cause a partial denial of service. With a CVSS 3.1 base score of 8.2 (High), this is a high-priority risk for any organization exposing Agile PLM to untrusted networks.

Technical Analysis

Oracle Agile PLM (Product Lifecycle Management) is an enterprise application used to manage product data, bills of materials, change orders, and supply-chain collaboration artifacts across a product's lifecycle. The vulnerability resides in the Application Server component, which exposes the web/HTTP-facing interface of the product. The NVD description states the flaw allows an unauthenticated attacker with network access via HTTP to compromise the application, yielding two distinct impacts: (1) unauthorized access to critical data or complete access to all Oracle Agile PLM accessible data, and (2) unauthorized ability to cause a partial denial of service.

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L tells us several important things:

• AV:N (Network): the attack is launched remotely over a network, consistent with HTTP exposure.
• AC:L (Low complexity): no special conditions or race windows are required; the attack is straightforward.
• PR:N (No privileges): authentication is not required — the flaw is reachable pre-auth.
• UI:N (No user interaction): no victim must click, open, or otherwise participate.
• S:U (Scope Unchanged): the impact is confined to the vulnerable component's security authority.
• C:H (High confidentiality): the confidentiality impact is severe — critical data exposure or full accessible-data access.
• I:N (No integrity impact): the vector explicitly records no integrity impact.
• A:L (Low availability): a partial denial of service is possible.

The confidentiality-dominant, no-integrity profile combined with no privileges required is characteristic of a pre-authentication data exposure / authorization bypass class of defect (reflected in CWE-306, Missing Authentication for Critical Function, selected as the closest applicable weakness). Because the NVD description does not name a specific endpoint, parameter, function, or library, we cannot attribute the root cause to a named code element. The practical takeaway is: an unauthenticated HTTP request can reach functionality that should never be reachable without authentication, returning sensitive data and/or degrading availability.

It is important to note the vector does not include integrity impact (I:N). This means the flaw as scored is not described as allowing an attacker to modify, insert, or destroy records. The exposure is confidentiality (data read) plus availability (partial DoS), which shapes both the detection and mitigation strategy: prioritize data-access monitoring and HTTP-layer anomaly detection, while leaving data-integrity validation as a secondary concern.

Because no public proof-of-concept, exploit code, or Nuclei template is available, the exact request sequence is not publicly documented. Any detection content below is necessarily behavioral and HTTP-layer in nature rather than signature-matched to a known payload.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class and the NVD-supplied facts (unauthenticated, network/HTTP, confidentiality-high, availability-low). No specific endpoint or parameter names are asserted because none are provided.

1. Reconnaissance / target identification The attacker identifies reachable Oracle Agile PLM Application Server instances over the network. Public internet exposure can be located via Shodan/censys queries matching Agile PLM titles, product banners, or the web service port typically associated with the application server (e.g., port 7001-class services, though operators must confirm the actual deployment port in their environment). Internal attackers simply need network reachability to the Application Server's HTTP listener.

2. Triggering the flaw class Because the CVSS vector records PR:N and the description explicitly states "unauthenticated attacker with network access via HTTP," the flaw is reachable without valid credentials. The attacker sends crafted HTTP requests to the Application Server's web-facing surface. The precise request is not documented publicly; at the vulnerability-class level, this is a missing-authentication / improper-access-control condition in which a request reaches data or functionality normally gated behind authentication. The attacker does not need to defeat login — they bypass the requirement that it exist at all on the affected path.

3. Payload / execution method At the class level, the "payload" is an HTTP request to an under-protected resource that the application returns without validating an authenticated session. There is no evidence this is remote code execution, no evidence of command injection, and no evidence of deserialization: the vector shows no integrity impact and the described outcome is data access plus partial DoS. Attackers would enumerate the Application Server's HTTP surface (directories, service endpoints, and response behaviors) to find the path that returns sensitive data or triggers the availability-degrading behavior. Repeated or malformed requests against that path are the likely mechanism for the partial denial of service (A:L).

4. Post-exploitation impact On success, the attacker obtains unauthorized access to critical Agile PLM data, or complete access to all data accessible through Agile PLM (C:H). Agile PLM commonly contains product designs, BOMs, supplier and cost data, change-management records, and related intellectual property — so exfiltration can be material. Additionally, the attacker can cause a partial denial of service (A:L), degrading availability for legitimate users. The absence of an integrity subscore (I:N) means the vector as scored does not describe tampering; defenders should nonetheless verify record integrity because once data is reachable, the full attack surface must be reassessed.

Impact Assessment

Business impact is high and concentrated in confidentiality. With C:H, a successful exploitation can expose "critical data or complete access to all Oracle Agile PLM accessible data." For product-centric enterprises, this can include confidential engineering data, IP, supplier pricing, and compliance-relevant records. The availability impact (A:L) adds a partial DoS that can disrupt PLM workflows for engineering, procurement, and supply-chain teams.

• Affected systems: Oracle Agile PLM 9.3.6 Application Server deployments. The description names 9.3.6 as the supported affected version; no other versions or components are confirmed in the supplied data.
• Blast radius: Bounded by S:U (scope unchanged) to the Agile PLM component's security authority, but the data reachable ("all Oracle Agile PLM accessible data") may be broad within the application.
• Attacker requirements: Trivial. AV:N + AC:L + PR:N + UI:N means no credentials, no user interaction, low complexity, remote.
• Exploit maturity: No public PoC, exploit code, or Nuclei template is known; there is no CISA KEV listing and no EPSS score at this time. This lowers the likelihood of immediate mass exploitation but does not lower the severity given the pre-auth, network-reachable nature.
• Priority: High. Unauthenticated remote data exposure on an internet- or partner-facing enterprise application warrants urgent triage.

Detection Guidance

Detection here must be behavioral and HTTP-centric because no payload signature is publicly available. The rules below are templates to be tuned to the local Agile PLM deployment (real hostnames, ports, and Application Server context paths). They intentionally do not hardcode any endpoint or parameter string that is not present in the source data.

Sigma Rule

title: Suspicious Unauthenticated HTTP Access to Oracle Agile PLM Application Server
id: 3f9a1c2e-7b4d-4a61-9e2f-8c1b6d5a0e42
status: experimental
description: Detects anomalous unauthenticated HTTP requests to Oracle Agile PLM 9.3.6 Application Server consistent with CVE-2026-87266 (pre-auth data exposure / partial DoS).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-87266
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_method:
    cs-method:
      - GET
      - POST
      - HEAD
  selection_agile:
    cs-uri-stem|contains:
      - '/Agile'
      - '/PLM'
      - '/pc'
      - '/AgilePLM'
  selection_unauthenticated:
    sc-status:
      - 200
      - 500
      - 503
  filter_authenticated:
    cs-username|exists: true
  condition: selection_method and selection_agile and selection_unauthenticated and not filter_authenticated
fields:
  - c-ip
  - cs-method
  - cs-uri-stem
  - sc-status
  - cs-User-Agent
falsepositives:
  - Legitimate unauthenticated landing pages or health checks
  - Load balancer probes
level: medium
tags:
  - attack.t1190
  - cve.2026.87266

YARA Rule

rule CVE_2026_87266_Agile_PLM_AppServer_Probe
{
    meta:
        description = "Detects HTTP request artifacts targeting Oracle Agile PLM Application Server (CVE-2026-87266)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-87266"
        severity = "high"

    strings:
        $app1 = "Agile PLM" nocase
        $app2 = "Oracle Agile" nocase
        $hdr1 = "Agile" nocase
        $path1 = "/Agile" nocase
        $path2 = "/PLM" nocase
        $meth1 = "GET /" nocase
        $meth2 = "POST /" nocase

    condition:
        uint16(0) == 0x4854 and
        (
            any of ($app*) or any of ($path*)
        ) and
        (
            any of ($meth*)
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-87266 Oracle Agile PLM Application Server Unauthenticated Access Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/Agile"; nocase; reference:cve,2026-87266; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-87266; classtype:attempted-recon; sid:202687266; rev:1;)

alert http any any -> any any (msg:"CVE-2026-87266 Oracle Agile PLM Application Server Potential Data Exposure (HTTP 200 to pre-auth path)"; flow:established,to_client; http.stat_code; content:"200"; http.response_body; content:"Agile"; nocase; reference:cve,2026-87266; classtype:attempted-user; sid:202687267; rev:1;)

alert http any any -> any any (msg:"CVE-2026-87266 Oracle Agile PLM Possible Partial DoS - Rapid Repeat Requests"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/Agile"; nocase; threshold:type both, track by_src, count 50, seconds 60; reference:cve,2026-87266; classtype:denial-of-service; sid:202687268; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=2m
  [ network where network.protocol == "http"
    and http.request.method in ("GET", "POST")
    and url.path : "/Agile*" ]
  [ network where network.protocol == "http"
    and http.response.status_code == 200
    and not http.request.headers.authorization : * ]

Splunk SPL Query

index=web sourcetype=access_combined
| eval path=lower(uri_path)
| where (match(path,"/agile") OR match(path,"/plm") OR match(path,"/pc"))
| eval authenticated=if(isnull(cookie) OR cookie="", "no", "yes")
| where authenticated="no" AND status IN (200, 500, 503)
| stats count values(status) as statuses values(useragent) as useragents by src_ip uri_path
| where count > 10
| sort - count
| table src_ip uri_path count statuses useragents

Wazuh OSSEC Rule

<group name="web,agile_plm,cve_2026_87266,">
  <rule id="2026872" level="10">
    <decoded_as>json</decoded_as>
    <field name="url">/Agile</field>
    <description>CVE-2026-87266: Unauthenticated access attempt against Oracle Agile PLM Application Server</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>

  <rule id="2026873" level="12">
    <if_sid>2026872</if_sid>
    <field name="status">200</field>
    <description>CVE-2026-87266: Possible successful pre-auth data access to Oracle Agile PLM</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>

  <rule id="2026874" level="12" frequency="50" timeframe="60">
    <if_sid>2026872</if_sid>
    <same_source_ip />
    <description>CVE-2026-87266: High-frequency requests to Oracle Agile PLM - possible partial DoS (A:L)</description>
    <mitre>
      <id>T1190</id>
      <id>T1499</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

No vendor patch or workaround is recorded in the supplied data. In the absence of a confirmed fix, prioritize containment.

1. Immediate mitigations

• Remove external exposure: block internet and untrusted-network access to the Oracle Agile PLM Application Server's HTTP interface via firewall/security-group/ACL rules. Restrict reachability to trusted management and user subnets only.
• Enforce authentication at the perimeter: place an authenticating reverse proxy or VPN in front of the Application Server so that unauthenticated HTTP requests cannot reach the vulnerable surface.
• Deploy WAF rules: add virtual-patching rules that block unauthenticated access to unexpected Agile PLM paths and rate-limit high-frequency requests to mitigate the partial DoS.
• Rate limiting and connection caps: throttle HTTP requests per source IP to reduce the availability impact (A:L).
• Increase monitoring: enable verbose web/HTTP logging and alert on unauthenticated 200 responses that return Agile PLM data.

2. Patch / upgrade steps

• Monitor Oracle's Critical Patch Update (CPU) advisories and the Oracle Security Alerts feed for an Agile PLM fix referencing CVE-2026-87266 and version 9.3.6 or later.
• When a fixed version is released, test in a staging environment, then upgrade/apply the patch during a controlled maintenance window.
• Track the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-87266) for updated vendor references and CPE applicability.
• Re-verify affected version scope (the supplied data names 9.3.6 as supported/affected) against Oracle's official advisory once published.

3. Long-term hardening

• Adopt a zero-trust posture for enterprise apps: no PLM application surface should be reachable unauthenticated from untrusted networks.
• Enforce defense-in-depth: network segmentation, an identity-aware proxy, and least-privilege data access within the application.
• Implement continuous vulnerability management and subscribe to Oracle CPU notifications to shrink patch latency.
• Maintain HTTP-layer detection (the Sigma/Suricata/Splunk/Wazuh content above, tuned to local context) to catch future pre-auth access-control regressions.
• Verify data-integrity baselines even though I:N is scored, since confidentiality compromise can precede further attacks.

References

• NVD — CVE-2026-87266: https://nvd.nist.gov/vuln/detail/CVE-2026-87266
• Oracle Security Alerts / Critical Patch Updates: https://www.oracle.com/security-alerts/
• CISA Known Exploited Vulnerabilities Catalog (checked — CVE-2026-87266 is NOT listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• FIRST EPSS (no score recorded for this CVE at time of writing): https://www.first.org/epss/
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/

Threat actor / in-the-wild note: No public PoC, exploit code, or Nuclei template is known for CVE-2026-87266, and there is no CISA KEV listing or exploit-in-the-wild evidence in the supplied data. No threat actor campaign is attributable at this time. This assessment should be revisited if a public exploit or KEV addition appears.