CVE-2026-61167

CriticalCVSS 9.8

Published: 21/07/2026(UTC)Updated: 29/07/2026(UTC)Translated: 24/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.47%

38th percentile - higher than 38% of all known CVEs

Summary

Vulnerability in Oracle Agile PLM (component: Security). Affected version is 9.3.6. Easily exploitable by unauthenticated attacker with network access via HTTP, potentially leading to takeover of Oracle Agile PLM. CVSS 9.8.

Risk Assessment

An attacker can fully compromise the product lifecycle management system, leading to loss of confidentiality and integrity of product data.

Recommendation

Apply the patch provided by Oracle or upgrade to a version that fixes this vulnerability.

Original NVD description (English source)

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Security). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks of this vulnerability can result in takeover of Oracle Agile PLM. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).