What is the CVSS score of CVE-2026-61167?

CVE-2026-61167 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Agile PLM are affected by CVE-2026-61167?

Oracle Agile PLM 9.3.6 contains a critical vulnerability (CVE-2026-61167, CVSS 9.8) enabling unauthenticated remote full application compromise.

How to fix or mitigate CVE-2026-61167?

Within 24 hours, identify all Oracle Agile PLM 9.3.6 instances in your environment and document their network exposure (internet-facing, intranet, or air-gapped). Within 7 days, implement firewall rules to restrict inbound access to authorized IP ranges only, deploy reverse-proxy authentication for any internet-exposed instances, and enable comprehensive audit logging for authentication and administrative activities. Within 30 days, monitor Oracle's security bulletins for an emergency patch (expected version 9.3.6.1 or later) and plan deployment within your change-control window; evaluate upgrade feasibility to Oracle Agile PLM 9.4 or later as an alternative remediation if patches are delayed.

Oracle Agile PLM CVE-2026-61167

EUVD-2026-47375 CRITICAL

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-84r7-3jwp-j897

Oracle Authentication Bypass Agile Plm

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle describes unauthenticated HTTP exploitation with no interaction yielding full takeover, so AV:N/AC:L/PR:N/UI:N and C:H/I:H/A:H with unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:23 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Security). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks of this vulnerability can result in takeover of Oracle Agile PLM. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle Agile PLM 9.3.6 (Security component) allows an unauthenticated remote attacker to take over the application over HTTP with no user interaction. Rated CVSS 9.8 with high impact to confidentiality, integrity, and availability, this flaw is disclosed via Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-privilege attack profile makes it a high-priority patch for internet- or intranet-exposed instances.

Technical ContextAI

Oracle Agile PLM is an enterprise Product Lifecycle Management platform used to manage product records, BOMs, change orders, and supply-chain collaboration; it is a Java/web-tier application typically fronted by an HTTP application server. The affected 'Security' component and the 'Information Disclosure' tag suggest a weakness in the authentication/authorization or session-handling layer that an attacker can reach directly over HTTP. Oracle assigns no CWE (CWE: N/A) and, per its standard CPU practice, withholds technical root-cause detail, so the exact class (e.g., authentication bypass, deserialization, or injection) cannot be confirmed from the available data; the C:H/I:H/A:H vector combined with 'takeover' language indicates the flaw ultimately yields full application control rather than mere data leakage.

RemediationAI

Apply the fixes from the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html); Oracle ships CPU fixes as patch sets for the affected 9.3.6 release, so download and apply the Agile PLM CPU patch for your version as the primary remediation - the input does not name a discrete fixed version string, so use the specific patch identified in the CPU for 9.3.6. Until patched, reduce exposure by restricting network access to the Agile PLM HTTP/HTTPS endpoints so they are reachable only from trusted internal segments or via VPN (trade-off: may break external supplier collaboration workflows), placing the application behind a WAF or reverse proxy with strict request filtering, and ensuring the instance is not internet-facing. Monitor application and web-tier logs for anomalous unauthenticated requests to the Security component. Patch status: Patch available per vendor advisory (Oracle CPU July 2026).