CVE-2026-61172 in Agile PLM
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Security). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Agile PLM accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/23/2026
The vulnerability resides within Oracle Agile PLM version 9.3.6, a component of Oracle Supply Chain that governs product lifecycle management processes. This security flaw represents a critical weakness in the system's authentication mechanisms, specifically affecting the HTTP protocol implementation that handles incoming network requests. The vulnerability affects the security framework that protects sensitive product data and manufacturing information within enterprise supply chain operations.
This particular vulnerability manifests as an insufficient authentication check that allows any remote attacker to gain unauthorized access without requiring valid credentials or prior authorization. The flaw operates at the network level through HTTP connections, making it highly accessible to threat actors who can simply connect to the system's exposed ports. The CVSS 3.1 scoring of 7.5 indicates a high severity threat with low attack complexity and no requirement for user interaction or privilege escalation. Attackers can exploit this vulnerability from any location that has network access to the affected Oracle Agile PLM instance, making it particularly dangerous in enterprise environments where such systems are often exposed to external networks.
The operational impact of this vulnerability extends beyond simple data theft, as successful exploitation could provide attackers with complete access to all data accessible through the Oracle Agile PLM system. This includes sensitive product designs, manufacturing specifications, supplier information, and other critical business data that forms the foundation of supply chain operations. The confidentiality impact is rated as high because the vulnerability allows unauthorized access to sensitive information without any authentication requirements, potentially exposing intellectual property and competitive advantages.
Security professionals should recognize this vulnerability through CWE-287, which categorizes improper authentication flaws in software systems. The attack pattern aligns with techniques described in MITRE ATT&CK framework under credential access and initial access phases, where adversaries seek to establish persistent unauthorized access to enterprise systems. Organizations running Oracle Agile PLM 9.3.6 should implement immediate mitigations including network segmentation, firewall restrictions, and mandatory authentication requirements for all HTTP endpoints. The vulnerability demonstrates a fundamental weakness in the system's security architecture that requires urgent patching or alternative access controls to prevent potential exploitation by malicious actors seeking to compromise enterprise supply chain data integrity and confidentiality.