Oracle Agile PLM CVE-2026-61180

Exploitation requires network access to the HTTP interface of the Product Quality Management component of Oracle Agile PLM for Process 6.2.4 AND a valid low-privileged application account (CVSS PR:L confirms authentication is required - this is authenticated exploitation, not unauthenticated). No user interaction is needed (UI:N) and attack complexity is low (AC:L), so once an attacker holds any low-level credential, no further special configuration is described as necessary. Limiting factors: the attacker must already possess valid credentials, only version 6.2.4 is named as affected, and reachability depends on the PQM web tier being exposed to the attacker's network - internal-only deployments meaningfully reduce the exposed attacker population.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8 High) signals genuine, non-trivial risk: network-reachable, low complexity, no user interaction, and only low privileges required, with total impact to all three security properties. Oracle's own 'easily exploitable' wording reinforces the low-complexity rating. However, no EPSS score, KEV listing, POC, or SSVC decision data was supplied, so exploitation probability cannot be quantified - the assessment rests on CVSS and vendor text alone. The tag 'Information Disclosure' partially conflicts with the description's 'takeover' and C:H/I:H/A:H impact, which imply far more than disclosure; treat the tag as an incomplete label and rely on the fuller CVSS/description. Net: this is a real priority for any organization running Agile PLM for Process, driven by ease of exploitation and full impact, but the absence of active-exploitation evidence means it is patch-cycle urgent rather than emergency zero-day.

An attacker with a legitimate but low-privileged Agile PLM for Process account (an internal employee, contractor, or someone who has phished/purchased such credentials) sends crafted HTTP requests to the Product Quality Management component. Because the flaw is easily exploitable with low complexity and no user interaction, the attacker escalates their access to fully compromise the application - reading and altering sensitive product/quality data and disrupting availability. No public POC is known, so exploitation currently requires the attacker to independently discover the request pattern.