CVE-2026-61173 in Agile PLM
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Security). The supported version that is affected is 9.3.6. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Agile PLM accessible data as well as unauthorized access to critical data or complete access to all Oracle Agile PLM accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
The vulnerability resides within Oracle Agile PLM version 9.3.6, specifically within the Security component of Oracle Supply Chain Management. This represents a significant security weakness that affects the core integrity and confidentiality controls of the platform. The flaw manifests as a difficult-to-exploit vulnerability that requires minimal attacker privileges, allowing unauthorized network-based adversaries to compromise the system through HTTP connections without requiring authentication credentials.
The technical nature of this vulnerability stems from insufficient access control mechanisms within the Agile PLM application's security framework. Attackers can leverage this weakness to execute unauthorized modifications to critical data structures and gain complete access to all data accessible through the platform. The CVSS 3.1 scoring system assigns a base score of 7.4, reflecting high severity implications with significant impacts to both confidentiality and integrity. The attack vector AV:N indicates network-based exploitation is possible, while AC:H suggests the complexity required for successful exploitation is moderate, making it a particularly concerning threat due to its accessibility.
The operational impact of this vulnerability extends beyond simple data compromise, as it enables attackers to create, delete, or modify critical system data without proper authorization. This comprehensive access capability allows malicious actors to fundamentally alter the integrity of the product lifecycle management processes that Oracle Agile PLM supports. Organizations relying on this platform face risks including unauthorized data manipulation, potential disruption of supply chain operations, and exposure of sensitive product information that could affect competitive positioning and regulatory compliance.
From a cybersecurity perspective, this vulnerability aligns with CWE-284 (Improper Access Control) and represents a critical gap in the application's security architecture. The ATT&CK framework categorizes this as a privilege escalation or persistence technique, where attackers can establish unauthorized access to system resources through network-based attacks. Organizations should implement immediate mitigations including network segmentation, firewall rule restrictions, and thorough monitoring of HTTP traffic to the affected system. The vulnerability demonstrates the importance of maintaining current security patches and conducting regular penetration testing to identify similar access control weaknesses in enterprise applications.
The implications for supply chain management are particularly severe since Agile PLM systems typically contain sensitive product data, manufacturing specifications, and supplier information that could be exploited for competitive advantage or industrial espionage. Organizations should conduct comprehensive risk assessments to determine the full scope of potential impact and consider implementing additional authentication layers or application firewalls to protect against this specific threat vector while awaiting official patches from Oracle.