CVE-2026-61173: Oracle Agile PLM Auth Bypass Vulnerability

CVE-2026-61173 Overview

CVE-2026-61173 is a high-severity vulnerability in the Security component of Oracle Agile PLM, part of the Oracle Supply Chain product family. The affected supported version is 9.3.6. An unauthenticated attacker with network access over HTTP can compromise Oracle Agile PLM, though successful exploitation requires overcoming high attack complexity. Successful attacks allow unauthorized creation, deletion, or modification of critical data, along with unauthorized read access to all data accessible by Oracle Agile PLM. Oracle disclosed the issue in its July 2026 Critical Patch Update.

Critical Impact
Unauthenticated network attackers can read, modify, or delete all data accessible through Oracle Agile PLM, impacting confidentiality and integrity of supply chain records.

Affected Products

Oracle Agile PLM version 9.3.6
Oracle Supply Chain product family
Security component of Oracle Agile PLM

Discovery Timeline

2026-07-21 - CVE-2026-61173 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Oracle publishes fix in the Oracle Critical Patch Update Advisory - July 2026

Technical Details for CVE-2026-61173

Vulnerability Analysis

CVE-2026-61173 resides in the Security component of Oracle Agile PLM 9.3.6, a Product Lifecycle Management (PLM) system used across supply chain operations. The flaw is reachable over HTTP and requires no authentication, but it carries high attack complexity, indicating exploitation depends on specific conditions outside the attacker's direct control. Oracle's advisory categorizes the impact as unauthorized access to critical data and unauthorized modification or deletion of all Oracle Agile PLM accessible data. Availability is not affected. Oracle has not published deeper technical details in the public advisory, consistent with its standard Critical Patch Update disclosure practice.

Root Cause

Oracle attributes the flaw to the Security component of Agile PLM. The advisory does not identify a specific Common Weakness Enumeration (CWE), and no CWE identifiers are assigned in NVD. Given the impact profile of full read and write access without authentication, the underlying defect is consistent with a broken access control or authentication bypass condition in an HTTP-exposed interface. Refer to the Oracle Security Alert July 2026 for vendor-supplied context.

Attack Vector

The attack vector is network-based over HTTP. The attacker requires no valid credentials and no user interaction. Because attack complexity is rated high, the attacker must complete additional preparation, such as reconnaissance of specific instance state or timing, before a reliable exploit succeeds. No public proof-of-concept, exploit module, or CISA KEV listing exists at the time of publication. EPSS data reports a low near-term exploitation probability, but Agile PLM's role in managing product data, bill-of-materials, and supplier records makes the asset attractive to targeted intrusions.

No verified exploit code is publicly available. See the Oracle Security Alert July 2026 for the authoritative vendor description.

Detection Methods for CVE-2026-61173

Indicators of Compromise

Unauthenticated HTTP or HTTPS requests to Agile PLM endpoints originating from external or unexpected internal sources.
Unexpected create, update, or delete operations against Agile PLM objects such as items, change orders, or BOMs outside normal business hours.
Application or web server log entries showing anomalous request patterns to Agile PLM Security component URLs.
Database audit entries indicating record modifications without a corresponding authenticated user session.

Detection Strategies

Correlate Agile PLM application logs with web server access logs to identify sessions performing privileged actions without a preceding authentication event.
Deploy signatures on network intrusion detection systems for anomalous HTTP request patterns targeting Agile PLM URLs.
Baseline normal API and web traffic to 9.3.6 instances and alert on deviations in request volume, source geography, or verb usage.
Monitor Agile PLM database tables for out-of-band modifications to critical records.

Monitoring Recommendations

Forward Agile PLM application server, web server, and database audit logs to a centralized SIEM for correlation and long-term retention.
Enable verbose logging on the Agile PLM Security component to capture authentication decisions and access outcomes.
Alert on privileged data changes performed by service accounts or anonymous sessions.
Review outbound network flows from Agile PLM hosts for signs of data exfiltration following suspicious inbound activity.

How to Mitigate CVE-2026-61173

Immediate Actions Required

Apply the Oracle July 2026 Critical Patch Update to all Oracle Agile PLM 9.3.6 deployments as soon as change control permits.
Inventory all Agile PLM instances, including test and disaster recovery systems, and confirm patch status for each.
Restrict network access to Agile PLM HTTP interfaces so only trusted internal networks and VPN clients can reach them.
Review Agile PLM audit logs for the period preceding patch deployment to identify potential prior exploitation.

Patch Information

Oracle addressed CVE-2026-61173 in the Critical Patch Update published in July 2026. Administrators should follow the guidance in the Oracle Critical Patch Update Advisory - July 2026 and apply the specified patches to Oracle Agile PLM 9.3.6. Oracle strongly recommends applying Critical Patch Update fixes without delay, as unpatched systems remain exposed once vendor advisories are public.

Workarounds

Place Agile PLM behind a reverse proxy or web application firewall configured to block unauthenticated access to Security component endpoints.
Enforce network segmentation so Agile PLM is not reachable from the internet or untrusted VLANs.
Require VPN or zero trust network access for all Agile PLM users until patching is complete.
Increase logging verbosity and shorten log review cycles while the vulnerability remains unpatched.

bash

# Example: restrict Agile PLM HTTP access at the perimeter (iptables)
iptables -A INPUT -p tcp --dport 7001 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 7001 -j DROP