Oracle Agile PLM CVE-2026-61170

Exploitation targets the Security component of Oracle Agile PLM 9.3.6 and is reachable by an unauthenticated attacker with network access over HTTP (PR:N, UI:N - no credentials and no user interaction required). The key limiting factor is high attack complexity (AC:H): the attacker must satisfy some condition outside their direct control - for example a specific race window, a non-default or particular configuration of the Security component, or possession/derivation of environment-specific information - which makes reliable exploitation difficult. Practical exposure is further limited to deployments whose Agile PLM HTTP interface is actually network-reachable to the attacker; internet-facing instances are at materially higher risk than internally-segmented ones.

The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) is the strongest and most complete signal: network-reachable and unauthenticated (PR:N, UI:N) with catastrophic impact, but tempered by high attack complexity (AC:H), which typically reflects a non-trivial precondition such as a race, specific configuration, or reliance on information the attacker must first obtain. No EPSS probability, no KEV listing, and no POC were provided, so real-world exploitation pressure appears low-to-moderate today despite the high base score - this is a patch-promptly-but-not-emergency item unless environment-specific exposure (internet-facing PLM) applies. Note the tension worth verifying: the summary description labels this a 'takeover' (full C/I/A) yet Oracle's tags include 'Information Disclosure' - the takeover framing dominates the CVSS impact metrics, so treat full compromise as the assumed outcome. Because CWE is N/A and no technical write-up exists, the exact exploitation path is inferred, not confirmed.

An attacker who can reach the Agile PLM web interface over HTTP sends a specially crafted request to the vulnerable Security component and, after satisfying the difficult precondition implied by the high attack complexity, bypasses authentication or access controls to gain full control of the PLM instance and its product/intellectual-property data. No public proof-of-concept is available, so this remains a theoretical chain based on the CVSS-described network, unauthenticated vector.