Oracle Agile PLM CVE-2026-61172

The only firm prerequisite is network HTTP access to an Oracle Agile PLM 9.3.6 instance's web interface; the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication and no user interaction are required, so exploitation works against a reachable default deployment. What limits exploitation is exposure and version: the target must be the specific supported version 9.3.6 and must be reachable by the attacker - instances confined to isolated internal networks or behind an authenticating proxy are substantially harder to reach. Impact is bounded to confidentiality (C:H/I:N/A:N), so the condition enables data disclosure only, not modification or service disruption.

The CVSS 3.1 base score is 7.5 (High) driven entirely by confidentiality (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N): network reachable, low complexity, no privileges, and no user interaction - an easy-to-exploit precondition profile. No EPSS score, KEV listing, POC, or SSVC decision data was provided, so exploitation probability cannot be quantified and there is no evidence of active exploitation. The 'Authentication Bypass' tag reinforces that the barrier to abuse is low once the instance is network-accessible, so despite the absence of exploit intelligence this should be treated as a genuine priority for internet- or partner-network-exposed Agile PLM instances; internal-only deployments carry lower realistic risk. Note the data gap: EPSS and POC status are unknown, so risk is inferred from the CVSS vector and vendor advisory rather than measured exploitation telemetry.

An attacker who can reach an exposed Oracle Agile PLM 9.3.6 web interface sends crafted HTTP requests that bypass authentication in the Security component, then reads sensitive product, engineering, and supplier data without valid credentials. Because no privileges or user interaction are required and attack complexity is low, exploitation is straightforward once the endpoint is discovered; no public exploit code has been identified at time of analysis.