CVE-2026-61169: 
Oracle Agile PLM vulnerability analysis and mitigation

CVE-2026-61169 is a local privilege escalation/information disclosure vulnerability in the Security component of Oracle Agile PLM (Product Lifecycle Management), part of Oracle Supply Chain. The affected version is 9.3.6. A low-privileged local attacker with logon access to the infrastructure where Oracle Agile PLM executes can exploit this vulnerability to gain unauthorized access to all critical data accessible by the application, with potential scope change impacting additional connected products. It was disclosed on July 21, 2026, as part of Oracle's Critical Patch Update (CPU) for July 2026, and carries a CVSS v3.1 base score of 6.5 (Medium) (Oracle Advisory).

The vulnerability resides in the Security component of Oracle Agile PLM version 9.3.6 and is classified as an elevation of privilege issue. The attack vector is local (AV:L), requiring low privileges (PR:L) and no user interaction (UI:N), with low attack complexity (AC:L). Exploitation results in a scope change (S:C), meaning the impact can extend beyond the vulnerable component to other products or systems connected to Oracle Agile PLM. The specific root cause (CWE classification) has not been publicly disclosed by Oracle, consistent with their standard vulnerability disclosure policy, and no public technical write-ups or proof-of-concept code are currently available (Oracle Advisory).

Successful exploitation allows a low-privileged local attacker to gain unauthorized access to critical data or complete access to all data accessible by Oracle Agile PLM, resulting in a high confidentiality impact. There is no integrity or availability impact. Because the scope is marked as changed, the vulnerability may enable access to data or systems beyond the immediate Oracle Agile PLM instance, potentially affecting other connected supply chain products (Oracle Advisory).

Oracle has released a patch for this vulnerability as part of the July 2026 Critical Patch Update (CPU), published on July 21, 2026. Organizations running Oracle Agile PLM version 9.3.6 should apply the patch immediately via the Oracle Supply Chain Products patch availability documentation. As interim mitigations, Oracle recommends restricting local logon access to the infrastructure hosting Oracle Agile PLM to only authorized personnel, implementing the principle of least privilege for system and service accounts, and monitoring and auditing application access for suspicious activity. Oracle strongly advises against relying on workarounds as a long-term solution (Oracle Advisory).