What is the CVSS score of CVE-2026-61171?

CVE-2026-61171 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle Agile PLM are affected by CVE-2026-61171?

Oracle Agile PLM 9.3.6 contains an unauthenticated authentication bypass allowing remote attackers to read, create, delete, or modify all application data without credentials.

How to fix or mitigate CVE-2026-61171?

Within 24 hours, identify and inventory all Oracle Agile PLM 9.3.6 instances and assess which are internet-accessible. Within 7 days, apply Oracle's July 2026 Critical Patch Update to all affected systems, prioritizing internet-facing and production deployments. Within 30 days, complete patching of all remaining systems and verify remediation through configuration audits.

Oracle Agile PLM CVE-2026-61171

EUVD-2026-47379 CRITICAL

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-xx66-xvq9-7xwp

Authentication Bypass Oracle Agile Plm

9.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

9.1 CRITICAL

Remote unauthenticated HTTP authentication bypass with no user interaction gives AV:N/AC:L/PR:N/UI:N; full data read and modification yield C:H/I:H, with no availability impact (A:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:21 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

CRITICAL 9.1

DescriptionCVE.org

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Security). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Agile PLM accessible data as well as unauthorized access to critical data or complete access to all Oracle Agile PLM accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Unauthenticated data compromise in Oracle Agile PLM 9.3.6 (Security component) allows a remote attacker with only HTTP network access to read, create, delete, or modify all data accessible to the application. The flaw is tagged as an authentication bypass and carries a CVSS 3.1 base score of 9.1; no public exploit identified at time of analysis, and it is not listed in CISA KEV. It was reported by Oracle's own security team and addressed in the Oracle July 2026 Critical Patch Update.

Technical ContextAI

Oracle Agile PLM is a Product Lifecycle Management suite within the Oracle Supply Chain family, used to manage product records, engineering change orders, BOMs, quality, and supplier data across manufacturing enterprises. The affected element is the product's Security component, and community tagging characterizes the issue as an authentication bypass, meaning access-control or session/authentication logic can be circumvented to reach protected functionality without valid credentials. No CWE was assigned by NVD (CWE: N/A), so the precise root-cause class is not formally categorized; the 'authentication bypass' tag combined with the CVSS confidentiality and integrity impacts points to a broken authentication/access-control weakness rather than a memory-safety or injection defect. Oracle does not publish CPE strings in its own advisories, and none were provided here, so exact affected build identifiers beyond the named version are not available.

RemediationAI

Apply the fixes delivered in the Oracle July 2026 Critical Patch Update, which is the vendor-released patch for this issue; consult https://www.oracle.com/security-alerts/cpujul2026.html for the specific Agile PLM 9.3.6 patch set and follow Oracle's Agile PLM patching procedure. No exact standalone fix build number was provided in the input, so identify the precise patch level from the CPU advisory rather than assuming one. Until patching is complete, reduce exposure by restricting network reachability to the Agile PLM HTTP interface - place it behind a VPN or internal-only segment and block untrusted inbound access, since the vector requires only HTTP network access; if the instance is internet-facing, front it with a reverse proxy or WAF and limit access to known corporate ranges. These network controls constrain the primary attack surface but do not remediate the underlying authentication-bypass flaw, and overly aggressive filtering may disrupt legitimate supplier or partner integrations, so validate access requirements before applying restrictions.