What is the CVSS score of EUVD-2026-47387?

EUVD-2026-47387 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Agile PLM are affected by EUVD-2026-47387?

Oracle Agile Product Lifecycle Management 6.2.4 (Product Quality Management component) contains a critical vulnerability (CVE-2026-61180, CVSS 8.8) enabling any authenticated low-privilege user to…

How to fix or mitigate EUVD-2026-47387?

Within 24 hours: audit all active user sessions in Oracle Agile PLM 6.2.4, document all systems running version 6.2.4, and restrict low-privilege account permissions to read-only access on sensitive data through role-based access controls. Within 7 days: implement network segmentation to isolate the Agile PLM 6.2.4 environment from untrusted networks, enable comprehensive audit logging of all authentication and privilege escalation attempts, and review audit logs for the past 30 days to identify any unauthorized access. Within 30 days: contact Oracle for patch release timeline and request interim guidance; begin evaluation of upgrade paths to supported versions (Oracle Agile PLM 6.2.5 or later); if immediate upgrade is not feasible, deploy database-level encryption and implement enhanced monitoring and access controls as described in compensating controls.

Oracle Agile PLM EUVD-2026-47387

| CVE-2026-61180 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-5c68-w65x-mqmr

Privilege Escalation Oracle Agile Product Lifecycle Management For Process

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network HTTP reach with low complexity and no user interaction, but a valid low-privileged account is required (PR:L); vendor 'takeover' language supports C:H/I:H/A:H with unchanged scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:19 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process. Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full product takeover in Oracle Agile Product Lifecycle Management for Process 6.2.4 (Product Quality Management component) allows a low-privileged, network-authenticated attacker to compromise confidentiality, integrity, and availability over HTTP. Oracle rates this 8.8 and describes it as 'easily exploitable,' meaning any user holding a valid low-level account can escalate to full application control. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, but the low attack complexity and high impact make it a strong patch priority.

Technical ContextAI

Oracle Agile Product Lifecycle Management (PLM) for Process is an enterprise supply-chain application suite used to manage product specifications, formulations, packaging, and regulatory/quality data - commonly in the food, beverage, CPG, and pharmaceutical industries. The affected Product Quality Management (PQM) component handles quality issues, corrective actions, and audits, typically exposed through a Java/web application tier reachable over HTTP(S). Oracle does not assign a CWE (listed as N/A) and, per its standard Critical Patch Update disclosure practice, withholds root-cause and vector detail; the 'takeover' language combined with C:H/I:H/A:H suggests a flaw that lets an authenticated user break out of their intended authorization boundary (e.g., broken access control or injection leading to code/command execution within the application context).

RemediationAI

Apply the fixes in the Oracle Critical Patch Update of July 2026 (Vendor-released patch per the Oracle CPU advisory: https://www.oracle.com/security-alerts/cpujul2026.html); Oracle publishes exact patch bundles/versions in that CPU matrix, so consult it for the specific 6.2.4 patch level and apply it during your next maintenance window or sooner given the 8.8 rating. Because exploitation requires an authenticated low-privileged account, interim compensating controls where immediate patching is impossible include: restricting network reachability of the PQM/Agile PLM web tier to trusted internal networks or VPN (reduces the AV:N exposure, at the cost of blocking legitimate remote users), tightening and auditing user account provisioning to minimize low-privilege accounts and enforce least privilege (limits the PR:L attacker pool), and enabling enhanced logging/WAF monitoring on the application endpoints to detect anomalous authenticated activity. These controls reduce but do not eliminate risk since any valid low-level credential can still reach the flaw; patching is the only definitive fix.