What is the CVSS score of CVE-2026-61181?

CVE-2026-61181 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle Agile PLM are affected by CVE-2026-61181?

Oracle Agile Product Lifecycle Management 6.2.4 (Product Quality Management component) contains a vulnerability allowing low-privileged authenticated users to access all application-sensitive data…

How to fix or mitigate CVE-2026-61181?

Within 24 hours: Identify and inventory all Oracle Agile PLM 6.2.4 instances running the Product Quality Management component; assess which users hold low-privilege access levels; begin documenting what sensitive data is accessible through the application. Within 7 days: Implement compensating controls by restricting low-privileged user permissions to quality data, enabling detailed audit logging of all data access and modification events, and requiring multi-factor authentication for accounts accessing the affected component. Within 30 days: Monitor Oracle security advisories for patch availability; evaluate operational feasibility of upgrading to a patched version or implementing additional application-level access controls to reduce the privileged user population.

Oracle Agile PLM CVE-2026-61181

EUVD-2026-47388 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-vhrp-rxg4-jj72

Authentication Bypass Oracle Agile Product Lifecycle Management For Process

7.6

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.6 HIGH

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

vuln.today AI

7.6 HIGH

Network HTTP access with a low-privilege account (PR:L) and required victim interaction (UI:R); high data disclosure (C:H), partial writes (I:L), no availability impact, and cross-component scope change (S:C).

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:18 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.6

DescriptionCVE.org

Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Agile Product Lifecycle Management for Process, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Agile Product Lifecycle Management for Process accessible data as well as unauthorized update, insert or delete access to some of Oracle Agile Product Lifecycle Management for Process accessible data. CVSS 3.1 Base Score 7.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N).

AnalysisAI

Sensitive data compromise in Oracle Agile Product Lifecycle Management for Process 6.2.4 (Product Quality Management component) lets a low-privileged, network-authenticated attacker read all application-accessible data and make limited unauthorized modifications, with a scope change that can significantly impact additional products. Oracle rates it easily exploitable but it requires tricking a separate user into interaction (UI:R), yielding a CVSS 3.1 base score of 7.6. No public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Oracle Agile Product Lifecycle Management (Agile PLM) for Process is an enterprise suite used to manage product data, specifications, quality, and regulatory compliance across supply chains; the affected Product Quality Management (PQM) component handles quality incidents, corrective actions, and audits. The CVSS vector's scope change (S:C) indicates the vulnerable web-tier component can affect resources beyond its own security authority - typical of cross-component or session/token abuse in a shared application server, and loosely consistent with the vendor-supplied 'Authentication Bypass' tag. Oracle does not publish a CWE for Critical Patch Update entries, so the precise weakness class (CWE: N/A) is not formally classified; the combination of required user interaction, high confidentiality impact, and scope change is characteristic of a forced-action or injection-style flaw (e.g., XSS/CSRF) rather than a direct memory-safety bug.

RemediationAI

Apply the fixes in Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html); Oracle delivers security patches only as cumulative CPU bundles, so install the current CPU patch for Agile PLM for Process 6.2.4 - no standalone fixed build number is published in the provided data, so the exact patched version could not be independently confirmed. As compensating controls until patching, restrict network reachability of the PQM web interface to trusted internal users via network segmentation or VPN, review and tighten low-privilege role assignments to shrink the pool of accounts that can reach the vulnerable component, and because exploitation depends on tricking another user, brief PQM users against clicking unexpected links or actions and enforce strict CSRF/same-site protections and WAF rules at the reverse proxy - noting these reduce but do not eliminate risk and may disrupt legitimate cross-component integrations.