Oracle Agile PLM CVE-2026-61171

The only concrete prerequisite is network access to the Oracle Agile PLM HTTP interface of a version 9.3.6 deployment; the CVSS vector (AV:N/AC:L/PR:N/UI:N) and the 'Authentication Bypass' tag indicate no valid credentials, no user interaction, and no special non-default configuration are required to trigger it. The practical limiting factor is reachability: Agile PLM is commonly deployed as an internal enterprise application, so exploitation is realistically constrained to attackers who can route HTTP to the server - internet-exposed instances are directly exploitable, while instances confined to internal networks require the attacker to first gain a network foothold. Impact is limited to confidentiality and integrity of Agile-PLM-accessible data (A:N), so it does not by itself cause service outage.

This is a genuine high priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated exploitation requiring no user interaction, and the C:H/I:H impacts justify the 9.1 score; availability is unaffected (A:N), consistent with a data-exposure/manipulation flaw rather than a crash or DoS. The 'Authentication Bypass' tag reinforces the PR:N rating and suggests exploitation could be automatable once a technique is known. No EPSS score, SSVC decision, KEV listing, or public POC was supplied, so real-world exploitation is not confirmed - the absence of these signals lowers immediate urgency relative to a KEV-listed bug, but does NOT lower the intrinsic exploitability, which is high. Because Oracle Agile PLM is typically an internal enterprise application, actual exposure depends heavily on whether the instance is internet-facing; internet-exposed deployments should be treated as urgent, internal-only ones as high-but-scoped. No conflicting signals were observed between the vector and the description - both indicate remote, unauthenticated, HTTP-based access.

An attacker who can reach the Agile PLM web interface over HTTP sends a crafted request that bypasses authentication in the Security component, gaining access without valid credentials. From there they read sensitive product, engineering, and supplier data (C:H) and can create, alter, or delete critical PLM records (I:H), for example tampering with bills of materials or change orders. Low attack complexity and no required user interaction make the attack straightforward once a working technique is known, though no public POC has been identified at time of analysis.