What is the CVSS score of CVE-2026-61166?

CVE-2026-61166 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Agile PLM are affected by CVE-2026-61166?

Oracle Agile PLM 9.3.6 contains a critical privilege escalation vulnerability (CVE-2026-61166) enabling complete application takeover with valid low-level user credentials.

How to fix or mitigate CVE-2026-61166?

Within 24 hours, identify all Oracle Agile PLM 9.3.6 instances in your infrastructure and restrict network access to trusted internal networks only, disabling external access if operationally feasible. Within 7 days, implement enhanced audit logging for privilege escalation and user group membership changes, review and minimize the number of low-privileged accounts with PLM access, require credential rotation for all low-privilege PLM users, and contact Oracle Support requesting interim mitigation guidance for version 9.3.6. Within 30 days, conduct forensic review of PLM access logs for suspicious low-privilege account activity since June 2026, establish patch deployment schedule for the security update once Oracle releases it, and develop tested rollback strategy for systems unable to patch immediately.

Oracle Agile PLM CVE-2026-61166

EUVD-2026-47374 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-7pjr-m6hf-wmhf

Oracle Authentication Bypass Agile Plm

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network HTTP access with low complexity and no user interaction, but a valid low-privileged account is required (PR:L), yielding full application takeover so C/I/A all High.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:23 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: User and User Group). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks of this vulnerability can result in takeover of Oracle Agile PLM. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full application takeover in Oracle Agile PLM 9.3.6 (Product Lifecycle Management) is possible via the User and User Group component, where a low-privileged authenticated user with HTTP network access can escalate to complete compromise of confidentiality, integrity, and availability. Rated CVSS 3.1 8.8 (High) and disclosed in Oracle's Critical Patch Update of July 2026, exploitation requires only valid low-level credentials and low attack complexity, making it attractive for insider or credential-theft abuse. No public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Oracle Agile PLM is an enterprise Product Lifecycle Management platform used to manage product records, BOMs, change orders, and supplier data across manufacturing supply chains; version 9.3.6 is a legacy on-premise release of this Java/web-tier application. The flaw resides in the User and User Group component, which governs account and access-group administration - a natural pivot point for privilege escalation since compromising user/group management typically cascades into control over the entire application's authorization model. Oracle did not assign a CWE (listed as N/A) and, per its standard CPU disclosure practice, withholds root-cause specifics; the 'Information Disclosure' tag combined with C:H/I:H/A:H suggests a weakness in the user/group handling logic that leaks or lets an attacker manipulate identity and permission data.

RemediationAI

Apply the patch delivered in Oracle's Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) - Patch available per vendor advisory; the input does not specify an exact patched build number, so administrators should pull the Agile PLM 9.3.6 patch set referenced in that CPU rather than relying on an invented version string. Because Agile PLM 9.3.6 is a legacy release, prioritize scheduling the CPU during the next maintenance window given C/I/A-High impact. As compensating controls until patching, restrict network reachability of the Agile PLM web tier to trusted management networks or VPN only (side effect: may break remote supplier/partner access), tighten and audit low-privilege account provisioning since exploitation requires an authenticated account (side effect: administrative overhead), and increase monitoring of the User and User Group administration functions for anomalous privilege or group changes (side effect: additional log review load).