What is the CVSS score of CVE-2026-61178?

CVE-2026-61178 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Agile PLM are affected by CVE-2026-61178?

Oracle Agile Product Lifecycle Management for Process 6.2.4 is vulnerable to unauthenticated remote takeover, exposing organizations' product designs, intellectual property, and regulatory compliance…

How to fix or mitigate CVE-2026-61178?

Within 24 hours: Audit network access logs and document all Oracle Agile PLM for Process 6.2.4 instances currently exposed to untrusted networks; assess their criticality to business operations. Within 7 days: Implement firewall rules and network segmentation to restrict TCP access to these instances to authorized administrative subnets only; enable comprehensive logging to detect exploitation attempts. Within 30 days: Establish contact with Oracle Support for patch release timelines; evaluate upgrade feasibility to Oracle Agile PLM for Process 6.2.5 or later if released; develop contingency plans to suspend or isolate the application if patch delivery timelines exceed organizational risk tolerance.

Oracle Agile PLM CVE-2026-61178

EUVD-2026-47385 CRITICAL

Improper Authentication (CWE-287)

2026-07-21 secalert_us@oracle.com

GHSA-fp6h-589p-42xr

Oracle Authentication Bypass Agile Product Lifecycle Management For Process

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Description confirms unauthenticated network TCP access with low complexity, no user interaction, and full product takeover, so PR:N/AC:L with C:H/I:H/A:H; scope unchanged as impact stays within the application.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:20 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Installation). The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Agile Product Lifecycle Management for Process. Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Complete takeover of Oracle Agile Product Lifecycle Management for Process 6.2.4 is possible by an unauthenticated remote attacker over TCP, per Oracle's July 2026 Critical Patch Update. The flaw resides in the product's Installation component and yields full compromise of confidentiality, integrity, and availability (CVSS 3.1 9.8). No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

Oracle Agile Product Lifecycle Management (PLM) for Process is an enterprise supply-chain/PLM suite (part of Oracle Supply Chain) used to manage product specifications, formulations, and compliance data, particularly in process industries such as food, beverage, CPG, and life sciences. The vulnerable area is the 'Installation' component of version 6.2.4, which typically covers deployment, setup, and application-server bootstrapping logic. Oracle did not assign a CWE (CWE: N/A), so the precise root-cause class (e.g., authentication bypass, deserialization, or injection) is not disclosed; however, the CVSS profile of an unauthenticated network vector leading to full takeover is consistent with an authentication/authorization bypass or remote code-execution weakness in an exposed service endpoint. The product is Java/application-server based and is commonly deployed on Oracle WebLogic, meaning the exposed listener is reachable over TCP as indicated in the description.

RemediationAI

Apply the fix delivered in Oracle's July 2026 Critical Patch Update; patch available per vendor advisory (https://www.oracle.com/security-alerts/cpujul2026.html) - Oracle did not publish a separate incremental fix-version string in the provided data, so consult the CPU matrix for the exact patch bundle for Agile PLM for Process 6.2.4 and apply it during the next emergency maintenance window. Because exploitation is unauthenticated over TCP, the highest-value compensating control until patching is completed is network isolation: restrict inbound TCP access to the Agile PLM application/WebLogic listener to trusted management networks and VPN-only segments via firewall or reverse-proxy ACLs, and remove any direct internet exposure of the installation/admin endpoints (trade-off: may interrupt remote integrations or partner connectivity that rely on that listener). Additionally, place the application behind a WAF and enable enhanced logging/monitoring on the listener to detect anomalous requests to the Installation component. These controls reduce reachability but do not remediate the underlying flaw, so patching remains mandatory.