What is the CVSS score of CVE-2026-61183?

CVE-2026-61183 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Agile PLM are affected by CVE-2026-61183?

Oracle Agile Product Lifecycle Management 6.2.4 contains a critical vulnerability allowing complete system takeover via unauthenticated remote access, with no vendor patch currently available.

How to fix or mitigate CVE-2026-61183?

Within 24 hours, inventory all systems running Oracle Agile PLM 6.2.4 and determine network exposure, specifically whether the Reporting component is accessible over HTTP from untrusted networks; prepare incident response procedures. Within 7 days, implement network-level restrictions to limit HTTP access to the PLM Reporting component through firewall rules or segmentation, deploy Web Application Firewall protections to block exploitation attempts, and enable enhanced audit logging and real-time alerting on component access. Within 30 days, establish a formal upgrade plan to Oracle Agile PLM version 6.2.5 or later once released by Oracle, test the upgrade path in a staging environment, and schedule phased deployment across production systems prioritizing internet-connected instances.

Oracle Agile PLM CVE-2026-61183

EUVD-2026-47390 CRITICAL

Improper Authentication (CWE-287)

2026-07-21 secalert_us@oracle.com

GHSA-87v5-64f9-h996

Oracle Authentication Bypass Agile Product Lifecycle Management For Process

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle describes easily exploitable unauthenticated network HTTP access yielding full product takeover, so AV:N/AC:L/PR:N/UI:N with C:H/I:H/A:H and unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:18 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Reporting). The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process. Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Complete takeover of Oracle Agile Product Lifecycle Management for Process 6.2.4 is possible when a remote, unauthenticated attacker reaches the Reporting component over HTTP, per Oracle's July 2026 Critical Patch Update. The CVSS 3.1 base score of 9.8 (C:H/I:H/A:H) reflects that a successful attack yields full confidentiality, integrity, and availability compromise of the product. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-authentication, low-complexity profile makes it a high patch priority.

Technical ContextAI

Oracle Agile Product Lifecycle Management for Process (Agile PLM for Process) is an enterprise supply-chain application used in regulated industries such as food/beverage, CPG, and pharmaceuticals to manage product specifications, formulations, compliance, and supplier data. The affected 'Reporting' component is a web-facing subsystem that generates and serves reports over HTTP. Oracle's advisory does not assign a CWE (listed as N/A) and does not disclose the root-cause weakness class; the 'Information Disclosure' tag combined with a full-takeover outcome suggests the flaw exposes or manipulates data through an unauthenticated report-facing endpoint, but the exact mechanism (e.g., injection, deserialization, auth bypass) is not published by Oracle in keeping with its standard non-disclosure practice for CPU entries.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) - Patch available per vendor advisory; Oracle publishes the specific patch numbers per product within the CPU, so administrators should locate the Agile PLM for Process 6.2.4 patch in the CPU patch availability matrix and schedule it as a priority. Because Oracle CPU entries do not disclose an independent standalone fix version, use the CPU-referenced patch as the authoritative remediation. As compensating controls until patching, restrict network access to the Reporting component and the Agile PLM for Process web tier to trusted internal networks or a VPN using firewall/ACL rules (trade-off: may break legitimate remote reporting/integration access), place the application behind a reverse proxy or WAF that filters requests to reporting endpoints (trade-off: rule tuning needed and not a guaranteed block for an unknown flaw), and increase monitoring of HTTP access to the reporting endpoints for anomalous requests. These are stopgaps only - the CPU patch is the definitive fix.