CVE-2026-61166 in Agile PLM
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: User and User Group). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks of this vulnerability can result in takeover of Oracle Agile PLM. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle Agile PLM version 9.3.6, specifically affecting the User and User Group component within Oracle Supply Chain. The flaw represents a critical security weakness that enables low privileged attackers to gain unauthorized access through HTTP network connections. The vulnerability's exploitability is classified as easily accessible, indicating that minimal technical expertise or resources are required to leverage this weakness effectively.
The technical nature of this vulnerability stems from insufficient access controls and authentication mechanisms within the user management subsystem. Attackers with minimal privileges can potentially escalate their access rights and compromise the entire Oracle Agile PLM environment through carefully crafted HTTP requests. This represents a significant authorization bypass flaw that violates fundamental security principles governing privileged access control systems. The vulnerability's classification under CWE 284 (Improper Access Control) demonstrates its core weakness in implementing proper user privilege validation and enforcement mechanisms.
Operationally, successful exploitation of this vulnerability can lead to complete system compromise and unauthorized administrative access to the Oracle Agile PLM platform. The confidentiality, integrity, and availability impacts are all rated as high, indicating that attackers could potentially read sensitive data, modify critical system information, or disrupt service availability entirely. This level of impact suggests that the vulnerability could enable attackers to manipulate product lifecycle management data, access confidential business information, and potentially cause operational disruptions that affect supply chain processes. The CVSS 3.1 score of 8.8 places this vulnerability in the high severity category, requiring immediate attention from security teams.
Organizations affected by this vulnerability should implement immediate mitigations including network segmentation to restrict HTTP access to the Oracle Agile PLM system, implementation of additional authentication layers, and thorough monitoring of user access patterns for unusual activities. The recommended approach involves applying Oracle's official security patches as soon as they become available, implementing web application firewalls to filter malicious HTTP requests, and conducting comprehensive access control reviews. Security teams should also consider reducing the attack surface by limiting direct network exposure of the PLM system and implementing multi-factor authentication mechanisms. This vulnerability aligns with ATT&CK technique T1078 (Valid Accounts) and T1566 (Phishing) as attackers could potentially leverage compromised user credentials or exploit this weakness to establish persistent access within supply chain management environments.