CVE-2026-61172: Oracle Agile PLM Information Disclosure

CVE-2026-61172 Overview

CVE-2026-61172 is a high-severity vulnerability in the Security component of Oracle Agile PLM, part of the Oracle Supply Chain product family. The affected version is Oracle Agile PLM 9.3.6. An unauthenticated attacker with network access via HTTP can exploit the flaw with low complexity and no user interaction. Successful exploitation results in unauthorized access to critical data or complete access to all Oracle Agile PLM accessible data. The vulnerability impacts confidentiality only, with no direct integrity or availability impact.

Critical Impact
Unauthenticated remote attackers can retrieve sensitive product lifecycle, supply chain, and intellectual property data stored in Oracle Agile PLM 9.3.6 deployments.

Affected Products

Oracle Agile PLM 9.3.6
Oracle Supply Chain product family (Agile PLM component)
Security component of Oracle Agile PLM

Discovery Timeline

2026-07-21 - CVE-2026-61172 published to the National Vulnerability Database
2026-07-21 - Last updated in NVD database
July 2026 - Addressed in the Oracle Critical Patch Update advisory

Technical Details for CVE-2026-61172

Vulnerability Analysis

The flaw resides in the Security component of Oracle Agile PLM 9.3.6. Oracle classifies the issue as an easily exploitable, network-reachable vulnerability that requires no authentication and no user interaction. Attackers reach the vulnerable code path over HTTP against the Agile PLM web interface.

Successful exploitation grants unauthorized read access to data managed by Agile PLM. Oracle's advisory states that impact can escalate to complete access to all Oracle Agile PLM accessible data. This category of information includes product designs, bills of materials, supplier records, engineering change orders, and other intellectual property.

The EPSS score is 0.398% (32.336 percentile), indicating a low current probability of observed exploitation. However, the low exploitation complexity and unauthenticated attack surface make Agile PLM deployments exposed to the internet particularly at risk.

Root Cause

Oracle has not published the underlying weakness classification (no CWE assignment is present in the CVE record). The advisory attributes the defect to the Security component, which handles authentication and authorization within Agile PLM. The confidentiality-only impact profile is consistent with an access control or authorization flaw that returns protected data to unauthenticated HTTP requests.

Attack Vector

The attack vector is network-based HTTP against the Agile PLM application server. An attacker sends crafted requests to the exposed Agile PLM endpoint without providing credentials. Because privileges required and user interaction are both none, exploitation can be automated at scale against internet-facing installations. See the Oracle Critical Patch Update - July 2026 advisory for vendor technical details.

Detection Methods for CVE-2026-61172

Indicators of Compromise

Unauthenticated HTTP or HTTPS requests to Oracle Agile PLM endpoints originating from unexpected external IP ranges.
Anomalous volumes of successful HTTP 200 responses to Agile PLM URIs without a preceding authenticated session.
Outbound data transfers from the Agile PLM application server that exceed baseline traffic patterns.

Detection Strategies

Inspect Agile PLM web server access logs for requests to Security component endpoints lacking valid session cookies or authentication headers.
Deploy web application firewall rules that flag repeated requests to Agile PLM URLs from a single source without authentication tokens.
Correlate authentication logs with data access logs to identify data retrieval events that occurred without a corresponding successful login.

Monitoring Recommendations

Enable verbose access logging on the Agile PLM application server and forward logs to a centralized SIEM for retention and analysis.
Baseline normal query and export volumes for Agile PLM users, then alert on statistical deviations.
Monitor egress traffic from Agile PLM hosts for large or unusual transfers to external destinations.

How to Mitigate CVE-2026-61172

Immediate Actions Required

Apply the fixes distributed in the Oracle Critical Patch Update - July 2026 to all Oracle Agile PLM 9.3.6 instances.
Restrict network access to the Agile PLM web interface using firewalls, VPNs, or reverse proxies until the patch is deployed.
Audit Agile PLM access logs from prior months for unauthenticated requests that returned application data.

Patch Information

Oracle released fixes for CVE-2026-61172 as part of the Oracle Critical Patch Update published in July 2026. Administrators should review the Oracle Critical Patch Update advisory, identify the Agile PLM patch identifier applicable to 9.3.6, and follow Oracle's documented patch deployment procedure. Oracle Critical Patch Updates are cumulative, so applying the July 2026 CPU also addresses prior Agile PLM security fixes.

Workarounds

Place the Agile PLM web interface behind an authenticating reverse proxy or VPN so unauthenticated HTTP requests cannot reach the application.
Restrict inbound access to Agile PLM to known corporate IP ranges using network access control lists.
Disable or block external access to any Agile PLM endpoints not required for business operations until patching is complete.

bash

# Configuration example: restrict Agile PLM access at the network edge
# Example iptables rule allowing only trusted corporate subnets on HTTPS
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP