What is the CVSS score of CVE-2026-61172?

CVE-2026-61172 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle Agile PLM are affected by CVE-2026-61172?

Oracle Agile PLM 9.3.6 contains an authentication bypass vulnerability allowing remote attackers to access critical business data without credentials, exposing product lifecycle information,…

How to fix or mitigate CVE-2026-61172?

Within 24 hours, isolate Oracle Agile PLM 9.3.6 systems from direct internet exposure by implementing network segmentation, disabling remote HTTP access, and restricting connectivity to verified internal networks only. Within 7 days, deploy Web Application Firewall rules to block unauthorized access patterns, enable comprehensive logging on all data access, and audit recent access logs for exploitation evidence. Within 30 days, establish contact with Oracle for patch timeline, evaluate migration to patched Agile PLM versions if available, and assess redesign of infrastructure to segregate sensitive PLM data from internet-facing systems.

Oracle Agile PLM CVE-2026-61172

EUVD-2026-47380 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-hhrp-hgc7-mw4g

Authentication Bypass Oracle Agile Plm

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated network HTTP authentication bypass with no user interaction gives AV:N/AC:L/PR:N/UI:N; impact is data disclosure only, so C:H and I:N/A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:21 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Security). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Agile PLM accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

AnalysisAI

Unauthorized data disclosure in Oracle Agile PLM 9.3.6 (Security component) lets a remote, unauthenticated attacker reach critical business data over HTTP without any user interaction. The Oracle CPU (July 2026) and EUVD tagging characterize this as an authentication-bypass-class weakness yielding full read access to all Agile PLM-accessible data. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

Oracle Agile PLM is an enterprise Product Lifecycle Management suite (part of Oracle Supply Chain) used to manage product records, BOMs, change orders, and supplier/compliance data, typically deployed as a Java/Oracle WebLogic-backed web application. The flaw resides in the product's Security component and is tagged as an Authentication Bypass, meaning access-control or session/authentication enforcement can be circumvented over the HTTP interface. No CWE was assigned in the source data, but an authentication-bypass leading to broad confidentiality loss is consistent with CWE-287 (Improper Authentication) or CWE-306 (Missing Authentication for Critical Function). Because the CVSS vector shows Scope:Unchanged with only Confidentiality impact (C:H/I:N/A:N), the issue enables reading data rather than modifying it or executing code.

RemediationAI

Apply the fixes from Oracle's Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html); Oracle CPUs deliver cumulative security patches, so the specific Agile PLM 9.3.6 patch listed there is the authoritative fix - an exact discrete fix build number was not included in the provided data, so treat this as Patch available per vendor advisory and pull the precise patch ID from the CPU matrix. As compensating controls until patching, restrict network reachability of the Agile PLM HTTP/HTTPS endpoints to trusted internal networks or VPN only and place them behind a WAF or reverse proxy that enforces authentication, since the attack is unauthenticated and network-borne; monitor web access logs for anomalous requests to Security/authentication-related endpoints. The trade-off of network restriction is reduced access for legitimate remote or supplier users, so validate integration flows before enforcing.