---
id: CVE-2026-83260
title: >-
  Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain
  (component: Event Java PX)
summary: >-
  Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain
  (component: Event Java PX).   The supported version that is affected is 9.3.6.
  Easily exploitable vulnerability allows high privileged attacker with network
  access via …
severity: critical
cvss: 9.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H'
cwe:
  - CWE-269
vendor: Oracle Corporation
product: Oracle Agile PLM
affected:
  - oracle_agile_plm 9.3.6
published: '2026-09-15'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T14:17:38.320'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-83260'
references:
  - url: 'https://www.oracle.com/security-alerts/cspusep2026.html'
    label: secalert_us@oracle.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-17T13:01:00.545074Z'
epss: 0.00462
epssPercentile: 0.37412
ingestedAt: '2026-09-15T20:44:02.507Z'
---

## Overview

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Event Java PX).   The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows high privileged attacker with network access via T3, IIOP to compromise Oracle Agile PLM.  While the vulnerability is in Oracle Agile PLM, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Agile PLM. CVSS 3.1 Base Score 9.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.