What is the CVSS score of CVE-2026-61185?

CVE-2026-61185 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of Oracle Agile PLM are affected by CVE-2026-61185?

Oracle Agile Product Lifecycle Management 6.2.4 contains an unauthenticated network-adjacent confidentiality vulnerability (CVSS 7.4) that allows unauthorized access to product lifecycle data and,…

How to fix or mitigate CVE-2026-61185?

Within 24 hours, inventory all systems running Oracle Agile PLM 6.2.4 and determine network exposure from adjacent segments; consider isolated environments or layered air-gapping if business context permits. Within 7 days, implement firewall rules restricting network access to the Installation component from trusted internal subnets only, deploy enhanced logging on authentication and data access events, and review connected product dependencies. Within 30 days, monitor Oracle's security advisories for patch availability, develop an upgrade or remediation plan to move beyond version 6.2.4, and conduct forensic audit for signs of unauthorized data disclosure.

Oracle Agile PLM CVE-2026-61185

EUVD-2026-47392 HIGH

Information Exposure (CWE-200)

2026-07-21 secalert_us@oracle.com

GHSA-wj35-x2qj-6r5c

Authentication Bypass Oracle Information Disclosure Agile Product Lifecycle Management For Process

7.4

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.4 HIGH

AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

7.4 HIGH

Adjacent-segment access (AV:A) and no authentication (PR:N, auth-bypass) with low complexity; confidentiality-only impact (C:H, I:N, A:N) and cross-product reach justify the scope change (S:C).

3.1 AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:17 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.4

DescriptionCVE.org

Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Installation). The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle Agile Product Lifecycle Management for Process executes to compromise Oracle Agile Product Lifecycle Management for Process. While the vulnerability is in Oracle Agile Product Lifecycle Management for Process, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Agile Product Lifecycle Management for Process accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).

AnalysisAI

Unauthorized data disclosure in Oracle Agile Product Lifecycle Management for Process 6.2.4 (Installation component) allows an unauthenticated attacker on the adjacent network segment to compromise confidentiality and, due to a scope change, impact additional connected products. The flaw is rated CVSS 3.1 7.4 with confidentiality-only impact and no integrity or availability effect. There is no public exploit identified at time of analysis, and it was disclosed by Oracle in the July 2026 Critical Patch Update.

Technical ContextAI

Oracle Agile Product Lifecycle Management (PLM) for Process is an enterprise supply-chain application used to manage product specifications, formulations, compliance, and sourcing data for regulated industries such as food, beverage, and consumer goods. The affected weakness sits in the product's Installation component, and the vendor tag labels it an 'Authentication Bypass', consistent with the CVSS PR:N (no privileges required) metric. No CWE was assigned in the source data, so the precise root-cause class is not formally classified; the tag and the AV:A adjacent vector suggest a network-reachable authentication or trust-boundary weakness exploitable by hosts sharing the same physical/local communication segment as the server. The CVSS scope change (S:C) indicates the vulnerable component and the impacted component differ, meaning a successful attack reaches beyond the PLM process boundary into other reachable products or data stores.

RemediationAI

Apply the fixes from the Oracle July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html), which is the vendor advisory addressing this issue for Agile PLM for Process 6.2.4; treat this as 'Patch available per vendor advisory' since the specific patched build number is not stated in the input data and should be taken directly from the CPU matrix. Because the attack vector is adjacent (AV:A), an effective compensating control while patching is to restrict the network segment the PLM server sits on: place it in a dedicated, access-controlled VLAN and enforce firewall/ACL segmentation so only authorized management and application hosts can reach it, which reduces the pool of hosts able to attack the physical communication segment at the trade-off of tighter operational network access. Additionally, monitor and limit which devices can join that segment (port security / NAC) to blunt insider or lateral-movement exploitation. Do not deploy or expose the server on a shared or flat corporate LAN until patched.