CVE-2026-61167 in Agile PLM
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Security). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks of this vulnerability can result in takeover of Oracle Agile PLM. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle Agile PLM version 9.3.6, a component of Oracle Supply Chain management systems that serves as a critical platform for product lifecycle management in enterprise environments. The flaw represents a severe security weakness that affects the system's authentication mechanisms and access controls. An attacker capable of sending HTTP requests to the affected system can exploit this vulnerability without requiring any prior authentication credentials or privileged access. This type of vulnerability is particularly dangerous because it operates at the network level, allowing remote exploitation from any location with internet connectivity to the target system.
The technical nature of this vulnerability stems from insufficient validation of incoming HTTP requests within the Oracle Agile PLM application layer. The flaw allows an unauthenticated attacker to execute arbitrary commands or operations against the affected system through carefully crafted HTTP traffic. This represents a critical failure in the principle of least privilege and proper access control implementation. According to CWE classification, this vulnerability aligns with CWE-287 which addresses improper authentication issues, and potentially CWE-352 for cross-site request forgery if the attack vector involves session manipulation. The vulnerability's exploitability is enhanced by its low attack complexity requirement, meaning that even basic network-level attacks can successfully compromise the system.
The operational impact of this vulnerability is catastrophic for organizations relying on Oracle Agile PLM for their product development and supply chain processes. Successful exploitation results in complete system takeover, enabling attackers to gain full administrative control over the platform. This compromise directly affects all three core security principles: confidentiality through potential data exfiltration, integrity by allowing unauthorized modifications to product data and configurations, and availability by potentially rendering the system unusable through destructive operations. Organizations may face significant business disruption including intellectual property theft, production process manipulation, and complete loss of access to critical product lifecycle management capabilities. The vulnerability affects all users of the 9.3.6 version regardless of their authentication status or network location.
Mitigation strategies should focus on immediate patching of the affected Oracle Agile PLM version 9.3.6 through official Oracle security updates and patches. Organizations must implement network segmentation to restrict access to the affected system, particularly limiting direct internet exposure. Network-level controls such as firewalls and intrusion detection/prevention systems should be configured to monitor and block suspicious HTTP traffic patterns. Access control measures including mandatory authentication for all system interactions should be enforced, with regular security audits conducted to identify any unauthorized modifications or access attempts. The ATT&CK framework categorizes this vulnerability under initial access techniques where attackers leverage weak authentication mechanisms, making it critical for organizations to implement comprehensive monitoring and response procedures. Additionally, organizations should consider implementing network access controls that limit exposure to only necessary users and systems, while maintaining detailed logging of all HTTP requests for forensic analysis purposes.