What is the CVSS score of CVE-2026-61186?

CVE-2026-61186 has a CVSS 3.1 base score of 9.4 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Agile eDM are affected by CVE-2026-61186?

Oracle Agile Engineering Data Management 6.2.1 contains a critical vulnerability allowing unauthenticated remote attackers to destroy or modify product lifecycle data, exfiltrate sensitive…

How to fix or mitigate CVE-2026-61186?

Within 24 hours: identify all Oracle Agile 6.2.1 deployments and assess network exposure; immediately implement firewall rules to restrict access to authorized networks only and disable any internet-facing instances. Within 7 days: check Oracle's security advisories for patched versions and begin upgrade planning; where upgrades cannot proceed immediately, implement web application firewall rules to restrict suspicious HTTP patterns and enable comprehensive request logging. Within 30 days: complete all version upgrades to the latest patched release; ensure all instances remain network-restricted and monitored for exploitation indicators.

Oracle Agile eDM CVE-2026-61186

EUVD-2026-47393 CRITICAL

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-4mw8-6fr8-2xmp

Oracle Authentication Bypass Agile Engineering Data Management

9.4

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.4 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

vuln.today AI

9.4 CRITICAL

Unauthenticated HTTP-reachable Install component gives AV:N/AC:L/PR:N/UI:N; impact matches Oracle's C:L (subset read) with high integrity (data modify/delete) and availability (complete DoS).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:17 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

CRITICAL 9.4

DescriptionCVE.org

Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Install). The supported version that is affected is 6.2.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile Engineering Data Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Agile Engineering Data Management accessible data as well as unauthorized read access to a subset of Oracle Agile Engineering Data Management accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Agile Engineering Data Management. CVSS 3.1 Base Score 9.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H).

AnalysisAI

Unauthenticated remote compromise of Oracle Agile Engineering Data Management 6.2.1 (Install component) lets attackers with only HTTP network access modify or destroy critical PLM data, read a subset of accessible data, and trigger a complete denial of service. Oracle rates it CVSS 9.4 and describes it as easily exploitable, but it is not in CISA KEV and no public exploit has been identified. The combination of no authentication requirement with high integrity and availability impact makes it a serious exposure for any network-reachable deployment.

Technical ContextAI

Oracle Agile Engineering Data Management (eDM, formerly Agile e-Series/EDM) is an engineering-data-management and product-lifecycle-management (PLM) platform in the Oracle Supply Chain suite, used to manage CAD files, engineering change orders, BOMs and related design data. The flaw sits in the 'Install' component and is reachable over HTTP, consistent with a web-facing application/setup tier. Oracle assigned no CWE (CWE: N/A), so the precise root-cause class cannot be confirmed from the available data; however, the CVSS profile - unauthenticated, network vector, high integrity/availability impact - is characteristic of a missing-authorization or exposed-unauthenticated-endpoint weakness in the install/setup tier.

RemediationAI

Apply the fixes from the Oracle July 2026 Critical Patch Update (Patch available per vendor advisory) documented at https://www.oracle.com/security-alerts/cpujul2026.html; Oracle CPUs ship security fixes as cumulative patches, so install the specific eDM 6.2.1 patch from that CPU matrix (an exact fixed build number is not stated in the available data and should be taken directly from the advisory). Because the vector is unauthenticated over HTTP, until patching completes restrict network reachability of the eDM application and its Install/setup endpoint to trusted management networks via firewall/ACL or reverse-proxy allow-listing, and place it behind a VPN rather than exposing it to the internet - the trade-off is reduced accessibility for remote engineering users. Ensure installer/setup endpoints are disabled or access-controlled in production, and monitor HTTP logs for anomalous data-modification or crash-inducing requests.