Oracle Agile PLM CVE-2026-61167

No special conditions - remote unauthenticated exploitation over HTTP against Oracle Agile PLM 9.3.6 (CVSS AV:N/AC:L/PR:N/UI:N). The only prerequisite is network reachability to the Agile PLM application's HTTP/HTTPS listener and the affected Security component. Limiting factors: the affected version is specifically 9.3.6, and because Agile PLM is commonly deployed on internal enterprise networks rather than the public internet, an attacker typically needs internal network access or a reachable exposed endpoint; no authentication, no specific non-default configuration, and no user interaction are required beyond that reachability.

All strong signals point to real, high priority: CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N is the worst-case profile - network reachable, low complexity, no privileges, no user interaction - and the S:U/C:H/I:H/A:H impact yields full compromise, hence the 9.8 base score. Mitigating the urgency, there is no EPSS score provided, no POC or exploit code identified, and no CISA KEV listing, so there is currently no evidence of active or automated exploitation; the risk is presently theoretical-but-severe rather than confirmed-in-the-wild. No SSVC decision data was supplied. The 'Information Disclosure' tag conflicts slightly with the 'takeover' / full C-I-A impact described - verify with the Oracle advisory whether the practical impact is data exposure escalating to takeover. Because Agile PLM is often deployed on internal networks rather than the public internet, real-world exposure depends heavily on network placement.

An attacker who can reach the Agile PLM web interface over HTTP - from the internet if exposed, or from a foothold on the corporate network - sends a crafted request to the vulnerable Security component without needing any credentials or user interaction. The request bypasses access controls and lets the attacker take over the application, reading sensitive product/IP data and manipulating records. No public POC has been identified, so exploitation would currently require the attacker to independently develop the exploit.