CVE-2026-61166: Oracle Agile PLM Privilege Escalation

CVE-2026-61166 Overview

CVE-2026-61166 is a high-severity vulnerability in Oracle Agile PLM, part of the Oracle Supply Chain product family. The flaw resides in the User and User Group component of Oracle Agile PLM version 9.3.6. An authenticated attacker with low privileges can exploit this vulnerability over the network via HTTP without any user interaction. Successful exploitation results in full takeover of the Oracle Agile PLM instance, impacting confidentiality, integrity, and availability. Oracle addressed this issue in the July 2026 Critical Patch Update.

Critical Impact
A low-privileged attacker with HTTP access can fully compromise Oracle Agile PLM, gaining control over product lifecycle data, user accounts, and supply chain records.

Affected Products

Oracle Agile PLM 9.3.6
Oracle Supply Chain product family (Agile PLM component)
Deployments exposing the Agile PLM web interface over HTTP

Discovery Timeline

2026-07-21 - CVE CVE-2026-61166 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Oracle addresses the issue in the Critical Patch Update

Technical Details for CVE-2026-61166

Vulnerability Analysis

The vulnerability affects the User and User Group component of Oracle Agile PLM 9.3.6. Oracle Agile PLM is an enterprise product lifecycle management platform that centralizes product data, engineering change orders, and supplier collaboration. The User and User Group component manages authentication contexts, role assignments, and access control lists.

An attacker holding valid low-privilege credentials can send crafted HTTP requests to endpoints exposed by this component. The vulnerability enables the attacker to escalate control and achieve full takeover of the application. Because Agile PLM often integrates with directory services, ERP systems, and manufacturing pipelines, compromise extends beyond the PLM boundary.

Oracle rates the flaw with high impacts across confidentiality, integrity, and availability. The EPSS score of 0.447% reflects current exploitation likelihood, though public exploit code is not yet available.

Root Cause

Oracle has not disclosed the specific defect class in the public advisory. The vulnerability sits in the user and group management subsystem, which typically handles privilege checks, session state, and role membership validation. Weak authorization enforcement on privileged operations is the most common root cause pattern for takeover-class flaws in this component category.

Attack Vector

The attack vector is network-based over HTTP. The attacker requires low-privilege credentials, which can be obtained through legitimate account provisioning, credential stuffing, or phishing against Agile PLM users. No user interaction is required. Once authenticated, the attacker issues requests against the vulnerable component to bypass authorization and achieve administrative control.

Refer to the Oracle Critical Patch Update July 2026 for the authoritative technical description and patch matrix.

Detection Methods for CVE-2026-61166

Indicators of Compromise

Unexpected additions or role changes within the User and User Group administration interface of Agile PLM.
HTTP requests from low-privilege user sessions targeting administrative endpoints for user or group management.
New administrative accounts or unexplained group membership modifications in Agile PLM audit logs.
Outbound connections from the Agile PLM application server to unfamiliar hosts following authenticated sessions.

Detection Strategies

Enable and centralize Oracle Agile PLM application audit logging, focusing on user creation, group membership, and privilege changes.
Correlate authentication events with subsequent administrative actions to flag privilege escalation patterns from low-privilege accounts.
Baseline normal HTTP request patterns to Agile PLM endpoints and alert on anomalous access to user management URLs.

Monitoring Recommendations

Forward Agile PLM application, web server, and database logs to a SIEM for correlation with identity and endpoint telemetry.
Monitor the application server host for unexpected process execution, file writes to web directories, or new scheduled tasks.
Track privileged group membership deltas on a scheduled basis and alert on out-of-band changes.

How to Mitigate CVE-2026-61166

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update for Oracle Agile PLM 9.3.6 as the primary remediation.
Inventory all Agile PLM instances, including test and disaster recovery environments, and confirm patch status.
Rotate credentials for Agile PLM service accounts and administrative users after patching.
Review Agile PLM audit logs for signs of prior exploitation before, during, and after the patch window.

Patch Information

Oracle released the fix in the July 2026 Critical Patch Update. Administrators should download and apply the update per Oracle's guidance in the Oracle Critical Patch Update July 2026 advisory. Validate the patch in a non-production environment before rolling to production, and confirm the update raises the Agile PLM build to the version specified in the advisory.

Workarounds

Restrict network access to the Agile PLM web interface using firewall rules or a reverse proxy that limits sources to trusted internal networks and VPN endpoints.
Enforce strong authentication and multi-factor authentication on all Agile PLM accounts to reduce the pool of usable low-privilege credentials.
Disable or lock unused Agile PLM user accounts and prune group memberships to minimize the attack surface until patching is complete.
Increase audit log verbosity for the User and User Group component and monitor closely during the pre-patch window.

bash

# Example: restrict Agile PLM HTTP access to trusted subnets at the firewall
iptables -A INPUT -p tcp --dport 7001 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 7001 -j DROP