What is the CVSS score of CVE-2026-61168?

CVE-2026-61168 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Agile Plm are affected by CVE-2026-61168?

Oracle Agile PLM 9.3.6 contains a critical account takeover vulnerability (CVE-2026-61168, CVSS 8.8) that permits authenticated attackers to fully compromise instances and access sensitive product…

How to fix or mitigate CVE-2026-61168?

Within 24 hours, inventory all Oracle Agile PLM instances running version 9.3.6 and assess network exposure. Immediately restrict HTTP access to Agile PLM instances using network-level controls (WAF, IP allowlisting) and enforce multi-factor authentication for administrative accounts. Within 7 days, implement continuous monitoring for suspicious authentication patterns and privilege escalation attempts, and contact Oracle Support to confirm patch availability timelines and any interim security guidance. Within 30 days, apply the vendor-released patch immediately upon availability, or if no patch emerges, evaluate migration to a supported Agile PLM release or alternative PLM platform.

Agile Plm CVE-2026-61168

EUVD-2026-47376 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-446x-pv2w-hp9m

Privilege Escalation Oracle Agile Plm

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (oracle) · only source for this CVE.

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:22 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Security). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks of this vulnerability can result in takeover of Oracle Agile PLM. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Account takeover in Oracle Agile PLM 9.3.6 (Security component) lets a low-privileged, remotely authenticated attacker fully compromise the product over HTTP, per Oracle's July 2026 Critical Patch Update. The flaw is rated easily exploitable with high confidentiality, integrity, and availability impact (CVSS 8.8) and results in complete takeover of the Agile PLM instance. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.