What is the CVSS score of CVE-2026-61179?

CVE-2026-61179 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Agile PLM are affected by CVE-2026-61179?

Oracle Agile Product Lifecycle Management for Process 6.2.4 (Product Quality Management component) contains a critical flaw enabling complete application takeover by authenticated network users,…

How to fix or mitigate CVE-2026-61179?

Within 24 hours: inventory all systems running Agile PLM 6.2.4 and assess whether PQM component is deployed; enable detailed access logging on affected instances and isolate systems from untrusted networks if operationally feasible. Within 7 days: implement network segmentation restricting access to Oracle Agile instances to trusted administrative subnets only, enable multi-factor authentication for all PLM user accounts, and deploy Web Application Firewall rules to detect and block exploitation attempts targeting authenticated PLM sessions. Within 30 days: evaluate upgrade options to Oracle Agile PLM versions released after July 2026 to obtain vendor-released patches; maintain heightened monitoring and quarterly review of access logs pending patched deployment.

Oracle Agile PLM CVE-2026-61179

EUVD-2026-47386 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-v3h3-3683-pqf4

Oracle Privilege Escalation Agile Product Lifecycle Management For Process

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network HTTP reach and low complexity give AV:N/AC:L; a valid low-privilege account is required so PR:L; full takeover yields C:H/I:H/A:H, agreeing with Oracle's rating.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:19 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process. Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full product takeover in Oracle Agile Product Lifecycle Management for Process 6.2.4 (Product Quality Management component) allows a low-privileged, network-authenticated attacker to compromise the entire application over HTTP. Oracle rates the flaw as easily exploitable with high confidentiality, integrity, and availability impact (CVSS 8.8). No public exploit identified at time of analysis, and it is not on CISA KEV; the only source is Oracle's July 2026 Critical Patch Update.

Technical ContextAI

Oracle Agile Product Lifecycle Management (PLM) for Process is an enterprise supply-chain and product-data management suite used to manage product specifications, quality, compliance, and formulation data. The affected element is the Product Quality Management component, exposed via HTTP as part of the web-based application. Oracle did not assign a CWE (listed as N/A) and provides no root-cause class; the 'takeover' outcome with combined C/I/A high impact and a low-privilege prerequisite is consistent with an authenticated web vulnerability such as injection, access-control bypass, or deserialization, but the exact weakness class is not disclosed in the available data.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html); the input does not specify a discrete patched build number, so treat the July 2026 CPU as the authoritative source and apply the Agile PLM for Process patch it references - patch available per vendor advisory, exact fixed version not independently confirmed. Until patched, restrict network reachability of the Agile PLM for Process web interface to trusted internal networks or VPN only, tighten and audit low-privilege application accounts (enforce least privilege and strong authentication) since exploitation requires a valid account, and monitor HTTP access logs to the Product Quality Management component for anomalous activity; these controls reduce exposure but do not eliminate risk for legitimate low-privilege users and may disrupt remote or partner access.