What is the CVSS score of CVE-2026-61184?

CVE-2026-61184 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle Agile PLM are affected by CVE-2026-61184?

A critical authentication bypass in Oracle Agile Product Lifecycle Management for Process 6.2.4 allows unauthenticated remote attackers to achieve full data compromise-reading, modifying, or deleting…

How to fix or mitigate CVE-2026-61184?

Within 24 hours: Identify all systems running Oracle Agile PLM for Process 6.2.4 and verify network accessibility; implement network-level access controls to restrict HTTP/HTTPS traffic to this component to known administrative IPs only, and disable direct internet exposure if present. Within 7 days: Apply compensating controls including network segmentation, WAF rules to enforce pre-authentication, or reverse proxy deployment; document and test control effectiveness. Within 30 days: Monitor Oracle's security advisories at security.oracle.com for patch availability and begin planning an upgrade to a patched version, completing testing in non-production environments.

Oracle Agile PLM CVE-2026-61184

EUVD-2026-47391 CRITICAL

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-m8f3-rr2w-26ff

Authentication Bypass Oracle Agile Product Lifecycle Management For Process

9.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

9.1 CRITICAL

Unauthenticated network HTTP access with low complexity and no user interaction (PR:N/UI:N/AC:L); full data read and modification give C:H/I:H, no DoS so A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:18 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

CRITICAL 9.1

DescriptionCVE.org

Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Agile Product Lifecycle Management for Process accessible data as well as unauthorized access to critical data or complete access to all Oracle Agile Product Lifecycle Management for Process accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Unauthenticated remote compromise of Oracle Agile Product Lifecycle Management for Process 6.2.4 (Product Quality Management component) lets network attackers read, create, modify, or delete all data accessible to the application over HTTP. Oracle rates it 'easily exploitable' with a CVSS 3.1 base score of 9.1 driven by full confidentiality and integrity impact, and community tagging labels it an authentication bypass. No public exploit identified at time of analysis, and it is not listed in CISA KEV; no EPSS score was provided.

Technical ContextAI

Oracle Agile Product Lifecycle Management (PLM) for Process is an enterprise supply-chain suite used for product data, formulation, specification, and quality management, typically deployed as a Java/HTTP web application in front of an Oracle database. The affected surface is the Product Quality Management (PQM) component of version 6.2.4. Oracle does not map this issue to a specific CWE (CWE: N/A), but the community 'Authentication Bypass' tag combined with a PR:N/UI:N vector points to a missing or broken authentication/access-control check (a CWE-287/CWE-306-class weakness) on an HTTP-reachable endpoint, allowing operations that should require a valid session to be performed anonymously. No CPE strings were supplied; the affected product identity comes from the Oracle advisory and ENISA EUVD entry.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html); Patch available per vendor advisory, though the exact patched build/patchset number for 6.2.4 is not enumerated in the provided data and should be confirmed directly from the CPU patch matrix and My Oracle Support. Because Oracle CPU fixes are cumulative, install the full July 2026 CPU rather than a partial patch. Until patching, restrict network reachability of the Agile PLM for Process HTTP interface - place it behind a VPN or restrict source IPs via firewall/reverse-proxy ACLs so only trusted internal hosts can reach the application and specifically the Product Quality Management endpoints, accepting that this limits legitimate remote/partner access. Add WAF or reverse-proxy rules to require an authenticated session on PQM URLs and monitor application and web-server logs for anonymous requests performing create/modify/delete operations. These are compensating controls only; given the unauthenticated network vector, prompt patching is the reliable fix.