What is the CVSS score of CVE-2026-61173?

CVE-2026-61173 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle Agile PLM are affected by CVE-2026-61173?

Oracle Agile PLM 9.3.6 contains an authentication bypass vulnerability that permits remote attackers to gain complete unauthorized access to all product lifecycle data without credentials.

How to fix or mitigate CVE-2026-61173?

Within 24 hours: Inventory all Oracle Agile PLM 9.3.6 instances and confirm which are accessible from untrusted networks (internet, cloud, partner VPNs); review HTTP access logs and database audit trails from the past 30 days for suspicious access patterns or anomalous queries. Within 7 days: Implement firewall rules restricting PLM access to internal corporate networks only; deploy Web Application Firewall rules to filter high-risk HTTP payloads; enable database query audit logging if not already active; brief PLM administrators and product teams on monitoring for indicators of compromise (unauthorized schema changes, bulk data exports, new user accounts). Within 30 days: Subscribe to Oracle security advisories and test patched versions as they release; conduct forensic database audit review to confirm data integrity; validate backup recoverability; stage and deploy patched Agile PLM version to production with change control and rollback procedures.

Oracle Agile PLM CVE-2026-61173

EUVD-2026-47381 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-r424-q88v-9cmj

Authentication Bypass Oracle Agile Plm

7.4

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.4 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

7.4 HIGH

Remote unauthenticated HTTP access (AV:N/PR:N/UI:N) but Oracle-confirmed difficult preconditions (AC:H); full read/write data impact (C:H/I:H) with no availability effect (A:N).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:21 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.4

DescriptionCVE.org

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Security). The supported version that is affected is 9.3.6. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Agile PLM accessible data as well as unauthorized access to critical data or complete access to all Oracle Agile PLM accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Unauthorized data access and manipulation in Oracle Agile PLM 9.3.6 (Security component) allows a remote unauthenticated attacker with HTTP access to read, create, delete, or modify all Agile PLM-accessible data. The high attack complexity (AC:H) means exploitation requires specific conditions the attacker cannot fully control, which lowers real-world exploitability despite the network-facing, no-authentication vector. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the 'Authentication Bypass' tag and full confidentiality/integrity impact make this a meaningful patch priority for exposed deployments.

Technical ContextAI

Oracle Agile PLM is Oracle's on-premises Product Lifecycle Management application used to manage product records, BOMs, change orders, quality and supplier data across manufacturing supply chains. The flaw resides in the product's Security component and is tagged as an Authentication Bypass, meaning the weakness likely allows an attacker to reach protected functionality or data without presenting valid credentials - behavior consistent with the CWE-287/CWE-306 (improper/missing authentication) class, though the CVE record lists CWE as N/A so the exact root-cause class is not formally assigned. The CVSS vector (S:U) indicates the impact is contained within the vulnerable Agile PLM authorization scope rather than crossing into other components.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 - patch available per vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html; no exact standalone fix build number is stated in the available data, so consult that CPU for the specific patch set applicable to Agile PLM 9.3.6 and apply it during your next maintenance window as Oracle CPU fixes are cumulative. Until patched, reduce exposure of the HTTP interface by restricting network access to the Agile PLM application to trusted internal networks or VPN and placing it behind a reverse proxy or WAF that enforces authentication, since the vector is remote and unauthenticated; note that restricting access may disrupt legitimate external supplier or partner integrations that rely on the web tier, so validate integration flows before locking down. Because the issue is tagged Authentication Bypass, also review and tighten authentication and session controls on the front-end tier as a defense-in-depth measure while the patch is scheduled.