CVE-2026-61169 in Agile PLM
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Security). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Agile PLM executes to compromise Oracle Agile PLM. While the vulnerability is in Oracle Agile PLM, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Agile PLM accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability exists within Oracle Agile PLM version 9.3.6, specifically within the Security component of Oracle Supply Chain Management. The flaw represents a significant security weakness that can be exploited by attackers with low privileges who already have logon access to the system infrastructure where Oracle Agile PLM operates. The CVSS 3.1 base score of 6.5 indicates a medium severity vulnerability with high confidentiality impact, reflecting the potential for unauthorized access to critical data within the system.
The technical nature of this vulnerability stems from insufficient authorization controls or improper access validation mechanisms within the Oracle Agile PLM application. The attack vector is classified as local access (AV:L), meaning an attacker must already have some level of system access to exploit the flaw. The low attack complexity (AC:L) suggests that the exploitation requires minimal technical skills and resources, while the low privilege requirement (PR:L) indicates that even users with limited system rights can leverage this weakness. The scope change (S:C) component is particularly concerning as it signifies that a successful attack on Oracle Agile PLM could potentially impact additional products beyond the immediate application, creating cascading security risks across interconnected systems.
The operational impact of this vulnerability extends far beyond the immediate Oracle Agile PLM environment, as demonstrated by the scope change aspect of the CVSS vector. An attacker who successfully exploits this vulnerability can gain unauthorized access to all data accessible through Oracle Agile PLM, potentially compromising sensitive product lifecycle management information, intellectual property, and business-critical data. The confidentiality impact is rated as high (C:H), indicating that successful exploitation could lead to complete disclosure of sensitive information within the system. This type of vulnerability directly relates to CWE-284, which addresses improper access control issues, and aligns with ATT&CK technique T1078 for Valid Accounts and T1566 for Phishing as attackers may leverage this weakness after establishing initial system access through other means.
Organizations should implement immediate mitigations including strengthening access controls, implementing least privilege principles, and monitoring for unauthorized access attempts within their Oracle Agile PLM environments. Regular security assessments and vulnerability scanning should be conducted to identify similar weaknesses across the supply chain management ecosystem. The scope change aspect necessitates a comprehensive approach to security monitoring that extends beyond individual applications to encompass interconnected systems and processes. Additionally, organizations should review and update their incident response procedures to account for potential cascading effects when addressing vulnerabilities in critical supply chain applications like Oracle Agile PLM.