CVE-2026-61173: 
Oracle Agile PLM vulnerability analysis and mitigation

CVE-2026-61173 is an authentication bypass vulnerability in the Security component of Oracle Agile PLM (Product Lifecycle Management), affecting version 9.3.6. It allows an unauthenticated attacker with network access via HTTP to compromise the application, resulting in unauthorized read and write access to critical data. The vulnerability was disclosed on July 21, 2026, as part of Oracle's July 2026 Critical Patch Update (CPU). It carries a CVSS v3.1 base score of 7.4 (High) (Oracle Advisory).

The vulnerability resides in the Security component of Oracle Agile PLM 9.3.6 and is classified as an authentication bypass (CWE not explicitly assigned, but consistent with improper authentication controls). An unauthenticated remote attacker can exploit this flaw over HTTP without requiring any user interaction or privileges, though the attack complexity is rated High, indicating that specific conditions or timing must be met for successful exploitation. No detailed technical write-up or public proof-of-concept code has been identified at this time (Oracle Advisory).

Successful exploitation allows an unauthenticated attacker to gain unauthorized read access to all Oracle Agile PLM accessible data, including potentially sensitive product lifecycle and supply chain information, as well as the ability to create, delete, or modify critical data within the system. The vulnerability has high confidentiality and integrity impacts, though availability is not affected. Given that Agile PLM manages sensitive engineering and product data, exploitation could expose proprietary intellectual property and disrupt business-critical records (Oracle Advisory).

Oracle has released a patch for this vulnerability as part of the July 2026 Critical Patch Update, available as of July 21, 2026. Organizations running Oracle Agile PLM version 9.3.6 should apply the CPU patch immediately. As interim measures, Oracle recommends restricting network access to the Agile PLM application to authorized users and networks, deploying Web Application Firewall (WAF) rules to detect and block authentication bypass attempts, and monitoring for suspicious unauthorized access patterns. Oracle strongly advises against relying on network-level controls as a long-term solution (Oracle Advisory).