What is the CVSS score of CVE-2026-61182?

CVE-2026-61182 has a CVSS 3.1 base score of 6.7 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Oracle Agile PLM for Process CVE-2026-61182

EUVD-2026-47389 MEDIUM

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-m29v-xp23-r35r

Oracle Privilege Escalation Agile Product Lifecycle Management For Process

6.7

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.7 MEDIUM

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

6.7 MEDIUM

Local attack vector and high privileges required reflect logon-to-infrastructure prerequisite; AC:L consistent with Oracle's 'easily exploitable' once access is obtained; full CIA reflects complete application takeover with unchanged scope.

3.1 AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:17 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Data Import). The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Agile Product Lifecycle Management for Process executes to compromise Oracle Agile Product Lifecycle Management for Process. Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full system takeover is achievable in Oracle Agile Product Lifecycle Management for Process 6.2.4 via the Data Import component, exploitable by a high-privileged attacker with local infrastructure access. Oracle classifies this as 'easily exploitable,' resulting in complete compromise of confidentiality, integrity, and availability despite the constrained attack surface. No public exploit code or CISA KEV listing exists at time of analysis, limiting immediate real-world risk to insider threat and post-compromise escalation scenarios.

Technical ContextAI

Oracle Agile Product Lifecycle Management for Process is an enterprise supply chain software suite used for managing product data, regulatory compliance, and supplier collaboration. The vulnerable component is 'Data Import,' which handles ingestion of external data into the PLM platform. The attack vector is local (AV:L), meaning exploitation occurs on the infrastructure host itself rather than over the network. No CWE has been assigned, so the precise root cause class - whether improper input validation, path traversal, privilege escalation, or insecure file handling during import processing - cannot be independently confirmed from available data. The affected version is 6.2.4, confirmed by Oracle's July 2026 Critical Patch Update (CPU) and corroborated by ENISA EUVD-2026-47389.

RemediationAI

Apply the patch provided in Oracle's Critical Patch Update for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html. An exact patched version number beyond 6.2.4 is not independently confirmed from available data - consult the CPU advisory directly for the precise release identifier. As compensating controls where patching is not immediately possible, restrict local logon access to the infrastructure host running Agile PLM for Process to the minimum necessary privileged accounts, enforce multi-factor authentication for administrative accounts, and audit Data Import usage logs for anomalous activity. Note that these controls reduce the insider threat window but do not eliminate the vulnerability for already-privileged users.