Oracle Agile PLM for Process CVE-2026-61182

Exploitation requires two explicit conditions: (1) the attacker must have a local logon session on the infrastructure host where Oracle Agile PLM for Process executes - remote network exploitation is not possible per AV:L; (2) the attacker must hold high-privilege credentials on that host (PR:H), such as an OS administrator or DBA-level account. The affected component is specifically Data Import, so the feature must be present and accessible. Limiting factors include the inability to exploit remotely, the requirement for pre-existing privileged access, and the fact that only version 6.2.4 is confirmed affected. Environments that restrict local logon to PLM infrastructure and enforce least-privilege principles for administrative accounts materially reduce exposure.

The CVSS 3.1 score of 6.7 (Medium) is consistent with the constrained attack prerequisites: AV:L requires the attacker to already have a local logon to the infrastructure, and PR:H requires high-privilege access - meaning an administrator or equivalent account is needed before exploitation can occur. These two factors together significantly reduce real-world exploitability compared to the full C:H/I:H/A:H impact triad, which represents a complete takeover. Oracle's own language 'easily exploitable' refers to low attack complexity (AC:L) once prerequisites are met, not ease of initial access. No EPSS data was provided, and the vulnerability carries no CISA KEV listing and no known public POC, further depressing near-term threat urgency. The primary realistic threat vector is a malicious insider, a compromised privileged account, or lateral movement from an already-breached host. The 'Information Disclosure' tag in the source data partially conflicts with the full CIA impact in the CVSS vector - this discrepancy should be verified against the Oracle advisory, as the vector implies broader impact than disclosure alone.

An attacker who has obtained high-privileged credentials - through credential theft, insider access, or lateral movement from another compromised host - logs on locally to the infrastructure running Oracle Agile PLM for Process 6.2.4 and interacts with the Data Import component. By supplying crafted input or exploiting a flaw in how imports are processed, the attacker escalates to full control of the PLM application, achieving read, modification, and disruption of all product lifecycle and supply chain data. No public POC exists, so the specific manipulation technique remains unconfirmed.