What is the CVSS score of CVE-2026-61188?

CVE-2026-61188 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Agile Product Lifecycle Management For Process are affected by CVE-2026-61188?

Oracle Agile Product Lifecycle Management for Process 6.2.4 contains a high-severity vulnerability enabling complete system compromise through low-privilege HTTP access, creating organizational risk…

How to fix or mitigate CVE-2026-61188?

Within 24 hours, identify all systems running Oracle Agile PLM 6.2.4 and immediately restrict HTTP network access to the Installation component via firewall rules, limiting to essential internal networks only. Within 7 days, disable the Installation component if operationally feasible, enable comprehensive access logging, and establish baseline monitoring for Installation component activity. Within 30 days, engage Oracle support for patch availability confirmation, prepare a non-production staging environment for testing upon patch release, and establish a 2-week production deployment timeline for any released patch.

Agile Product Lifecycle Management For Process CVE-2026-61188

EUVD-2026-47395 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-rgq8-w5vh-3jq5

Oracle Privilege Escalation Agile Product Lifecycle Management For Process

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (oracle) · only source for this CVE.

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:16 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Installation). The supported version that is affected is 6.2.4. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process. Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full product takeover in Oracle Agile Product Lifecycle Management for Process 6.2.4 (Installation component) allows a low-privileged attacker with HTTP network access to fully compromise the application, yielding high confidentiality, integrity, and availability impact. The Oracle July 2026 Critical Patch Update rates this CVSS 3.1 7.5 but flags it as difficult to exploit (AC:H). No public exploit is identified at time of analysis and it is not listed in CISA KEV.