Oracle Agile PLM CVE-2026-61184

Exploitation requires only network HTTP access to an exposed Oracle Agile Product Lifecycle Management for Process 6.2.4 instance with the Product Quality Management component in use; the CVSS vector AV:N/AC:L/PR:N/UI:N and Oracle's 'easily exploitable' rating indicate no authentication, no user interaction, and no non-default configuration are needed against a reachable deployment. The primary limiting factor is exposure: the application's HTTP interface (and the PQM endpoints specifically) must be reachable by the attacker, so instances confined to internal networks or behind VPN/ACLs are far less exposed. Version is a hard limiter - only 6.2.4 is confirmed affected - and impact is limited to data confidentiality and integrity (A:N means no availability/denial-of-service effect).

The signals that are present align on high priority: CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N means network-reachable, low-complexity, unauthenticated exploitation with no user interaction, and Oracle explicitly calls it 'easily exploitable' - a phrasing Oracle reserves for issues needing no specialized conditions. Impact is scoped to the vulnerable system (S:U) but is severe for data, with C:H and I:H (A:N, so no availability/DoS impact), consistent with the 9.1 score. Counterbalancing this, several exploitation-likelihood signals are simply absent: no EPSS probability, no SSVC decision data, no KEV listing, and no evidence of public POC - so real-world exploitation cannot be confirmed and remains inferred from the vector rather than observed. The 'Authentication Bypass' tag is community-supplied metadata, not an Oracle-confirmed root cause, and should be treated as a strong hint rather than fact. Net: a genuinely high-priority patch candidate for any organization running Agile PLM for Process 6.2.4, but the low deployment footprint of this product means exploitation is more likely to be targeted than opportunistic/mass-scanned.

An attacker who can reach the Agile PLM for Process web interface sends crafted HTTP requests to a Product Quality Management endpoint that fails to enforce authentication, and without any credentials reads sensitive product/quality data and creates, alters, or deletes critical records. Given AV:N/AC:L/PR:N/UI:N and Oracle's 'easily exploitable' rating, no user interaction or special timing is needed; no public POC has been identified at time of analysis, so exploitation would require the attacker to independently develop the request sequence.