Oracle Agile PLM CVE-2026-61173

Exploitation targets the Security component of Oracle Agile PLM version 9.3.6 specifically and requires only network reachability to the application's HTTP service - the CVSS vector (AV:N/PR:N/UI:N) confirms no authentication and no user interaction are needed. The key limiting factor is the high attack complexity (AC:H): Oracle classifies this as 'difficult to exploit,' meaning success depends on conditions the attacker does not control (such as a specific server configuration, state, or timing) rather than being reliably repeatable against any exposed instance. Only version 9.3.6 is listed as affected, and the target's Agile PLM HTTP endpoint must be network-accessible to the attacker; instances confined to isolated internal segments are substantially harder to reach.

The CVSS 3.1 base score is 7.4 (High), driven by network vector (AV:N), no privileges (PR:N), no user interaction (UI:N), and high confidentiality and integrity impact (C:H/I:H) with no availability impact (A:N). The single most important mitigating signal is AC:H - Oracle rates this 'difficult to exploit,' implying the attack depends on conditions outside the attacker's direct control, which materially reduces the likelihood of mass, opportunistic exploitation. No EPSS score was provided in the input, so exploitation probability cannot be quantified here; no POC and no CISA KEV listing means there is no evidence of active exploitation or available weaponized code at this time. The apparent tension between an unauthenticated network vector plus an 'Authentication Bypass' tag (which suggests high impact) and the AC:H rating should be verified against the Oracle advisory - Oracle typically assigns AC:H when preconditions such as specific configuration, timing, or environmental state are required. Net: a genuine High-severity issue worth prioritized patching on internet- or partner-exposed instances, but not an emergency zero-day-grade event based on available data.

A remote attacker who can reach the Oracle Agile PLM HTTP interface crafts requests that abuse the Security component's authentication handling to bypass access controls and read or tamper with product, change-order, and supplier data without valid credentials. Because Oracle rates the attack as difficult (AC:H), success likely depends on hitting a specific server state or configuration, so the attacker may need repeated attempts or particular environmental conditions. No public exploit code is identified at time of analysis, so an attacker would need to independently develop the technique.