What is the CVSS score of CVE-2026-61170?

CVE-2026-61170 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Agile PLM are affected by CVE-2026-61170?

A critical vulnerability in Oracle Agile PLM 9.3.6 enables complete system compromise through unauthenticated remote HTTP attacks on the Security component.

How to fix or mitigate CVE-2026-61170?

Within 24 hours, identify all Oracle Agile PLM 9.3.6 deployments and verify exposure to remote HTTP access, consulting Oracle's July 2026 Critical Patch Update for affected configurations. Within 7 days, implement network segmentation to restrict HTTP access to PLM systems, deploy Web Application Firewall rules targeting the Security component, and establish enhanced access logging and alerting on these systems. Within 30 days, monitor vendor advisories for patch availability, plan a version upgrade to a patched release, and formalize compensating controls for any systems that cannot be immediately remediated.

Oracle Agile PLM CVE-2026-61170

EUVD-2026-47378 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-vjf2-x843-r7wm

Oracle Authentication Bypass Agile Plm

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network-reachable HTTP with no auth or interaction (AV:N/PR:N/UI:N), but a difficult precondition warrants AC:H; described full takeover justifies C:H/I:H/A:H, scope unchanged.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:22 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Security). The supported version that is affected is 9.3.6. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks of this vulnerability can result in takeover of Oracle Agile PLM. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full product takeover of Oracle Agile PLM 9.3.6 (Product Lifecycle Management) is possible by an unauthenticated remote attacker over HTTP against the Security component, per Oracle Critical Patch Update July 2026. The CVSS 3.1 base score is 8.1 with high attack complexity, meaning exploitation is difficult and likely requires specific conditions or timing to succeed, but a successful attack yields complete compromise of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV; no EPSS score was supplied.

Technical ContextAI

Oracle Agile PLM is an enterprise Product Lifecycle Management application used to manage product records, BOMs, change orders, and supplier data, typically deployed as a Java/Oracle WebLogic-based web application behind corporate networks. The flaw resides in the 'Security' subcomponent and is reachable over HTTP, indicating a web-facing authentication, session, or access-control weakness rather than a backend batch process. No CWE was assigned in the source data, so the precise root-cause class (e.g., authentication bypass, deserialization, or injection) cannot be confirmed; the 'Information Disclosure' tag combined with the Security component and full C/I/A impact suggests a flaw that leaks or bypasses security controls to escalate into full takeover.

RemediationAI

Apply the fixes from the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html); Oracle distributes Agile PLM security fixes exclusively through the CPU patch bundles, so administrators should download and apply the relevant CPU patch for Agile PLM 9.3.6 from My Oracle Support rather than an individually tagged version (no standalone fix version string was provided in the input, so no exact patch build number can be cited here). Until patched, reduce exposure by ensuring the Agile PLM web tier is not reachable from the internet - restrict HTTP/HTTPS access to the application to trusted internal networks and VPN via firewall or reverse-proxy allow-listing, which limits the network attack vector at the cost of remote-user convenience. Increase monitoring/WAF logging on the Agile PLM Security/login endpoints to detect anomalous unauthenticated requests; this adds detection but no prevention, so patching remains the only durable fix.