What is the CVSS score of EUVD-2026-47377?

EUVD-2026-47377 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Oracle Agile PLM EUVD-2026-47377

| CVE-2026-61169 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-358j-qrvj-pgvh

Authentication Bypass Oracle Agile Plm

6.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Local vector and low privilege confirmed by description; scope change and high confidentiality reflect cross-boundary data access; no integrity or availability impact described.

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:18 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Security). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Agile PLM executes to compromise Oracle Agile PLM. While the vulnerability is in Oracle Agile PLM, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Agile PLM accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).

AnalysisAI

Local privilege escalation via authentication bypass in Oracle Agile PLM 9.3.6 allows a low-privileged attacker with existing local infrastructure access to gain unauthorized read access to all PLM-accessible data, with confirmed scope change effects that may extend compromise to additional Oracle supply chain products. The CVSS vector (AV:L/PR:L/S:C/C:H) confirms exploitation is constrained to local infrastructure foothold but produces high-impact confidentiality loss across trust boundaries. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

Oracle Agile PLM (Product Lifecycle Management) version 9.3.6 is an enterprise platform managing product data, engineering change orders, and supply chain workflows across large manufacturing organizations. The vulnerability resides in the Security component - the subsystem responsible for enforcing access controls and authentication decisions within the PLM application. The 'Authentication Bypass' tag indicates the Security component fails to correctly enforce authorization boundaries once a user is locally authenticated, allowing privilege escalation to data beyond the attacker's assigned role. The CVSS scope change metric (S:C) signals the flaw crosses a security boundary, meaning the impact propagates beyond the Oracle Agile PLM process itself to affect other products or data stores within the Oracle Supply Chain ecosystem. No CWE classification was provided, but the pattern is consistent with improper authorization (CWE-285) or broken access control (CWE-284) in a security enforcement layer.

RemediationAI

Apply the Oracle Critical Patch Update (CPU) for July 2026, which addresses this vulnerability in Oracle Agile PLM 9.3.6; the advisory is available at https://www.oracle.com/security-alerts/cpujul2026.html. The exact patched version increment beyond 9.3.6 was not independently confirmed from available data - administrators must consult the Oracle CPU advisory directly to obtain the specific patch bundle and verify the fix version. As compensating controls pending patching, restrict local logon access to the Oracle Agile PLM host infrastructure to only those accounts with verified operational necessity, and audit all low-privilege local accounts for legitimacy; this directly addresses the PR:L prerequisite and reduces the exploitable attacker pool. Enable enhanced access logging on the PLM Security component to detect anomalous data access patterns consistent with bypass activity. Note that restricting local accounts may affect legitimate administrative and batch processing workflows and should be coordinated with application owners before implementation.