Oracle Agile PLM CVE-2026-61185

Exploitation requires the attacker to have access to the physical communication segment attached to the hardware where Oracle Agile Product Lifecycle Management for Process 6.2.4 executes - i.e. adjacent-network (Layer 2 / same LAN or broadcast domain) reachability, not internet-facing remote access. No authentication is required (CVSS PR:N, tagged 'Authentication Bypass') and no user interaction is needed (UI:N), and the attack complexity is low, so against a reachable, unpatched 6.2.4 Installation component no further special configuration is stated as necessary. The primary limiting factor is the adjacency requirement: an attacker must first obtain a network position on the server's local segment (insider access, compromised same-segment host, or prior lateral movement), which meaningfully narrows realistic exploitation compared to a fully remote (AV:N) flaw. Impact is confidentiality-only, so it enables data disclosure rather than modification or denial of service.

The CVSS 3.1 base score of 7.4 (High) is driven by an adjacent attack vector (AV:A), low complexity (AC:L), no privileges (PR:N), no user interaction (UI:N), a scope change (S:C), and high confidentiality impact with no integrity or availability effect (C:H/I:N/A:N). The key limiting factor is AV:A: the attacker must have access to the physical communication segment attached to the hardware, so this is not internet-wide remotely exploitable and realistically requires a foothold on the same LAN/broadcast segment, an insider position, or lateral movement. No EPSS score, KEV listing, or POC signal was provided, so exploitation likelihood cannot be quantified and there is no public exploit identified at time of analysis. The signals are internally consistent - Oracle-reported, confidentiality-only, adjacent-access - indicating a real but access-constrained data-disclosure risk rather than a mass-exploitation candidate; the scope change slightly elevates concern because impact can extend to additional products. Missing data (no EPSS, no CWE, no independent advisory beyond the Oracle CPU landing page) means real-world exploitation probability is unconfirmed.

An attacker who has gained a position on the same local/physical network segment as the Oracle Agile PLM for Process server - for example a malicious insider, a compromised workstation, or a foothold obtained through lateral movement - sends crafted traffic to the exposed Installation component and bypasses authentication to read critical product-lifecycle data. Because the flaw carries a scope change, the attacker may also reach confidential data in additional connected products. No public exploit is identified at time of analysis, so this would require attacker-developed tooling.