CVE-2026-61184: Oracle Agile PLM Auth Bypass Vulnerability

CVE-2026-61184 Overview

CVE-2026-61184 affects Oracle Agile Product Lifecycle Management (PLM) for Process version 6.2.4, specifically within the Product Quality Management component. The flaw allows an unauthenticated attacker with network access via HTTP to compromise the application without user interaction. Successful exploitation grants read, create, delete, and modify access to all data accessible through the Oracle Agile PLM for Process instance. Oracle disclosed the issue in the July 2026 Critical Patch Update.

Critical Impact
Remote, unauthenticated attackers can gain full read and write access to critical product lifecycle data over HTTP with low attack complexity.

Affected Products

Oracle Agile Product Lifecycle Management for Process 6.2.4
Component: Product Quality Management
Oracle Supply Chain product family

Discovery Timeline

2026-07-21 - CVE-2026-61184 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Addressed in Oracle Security Alert July 2026

Technical Details for CVE-2026-61184

Vulnerability Analysis

The vulnerability resides in the Product Quality Management component of Oracle Agile PLM for Process 6.2.4. An attacker reaches the affected functionality over the network using HTTP without any authentication or user interaction. The impact profile shows high confidentiality and integrity consequences with no availability impact, indicating the flaw enables data disclosure and unauthorized modification rather than service disruption.

Oracle categorizes the vulnerability as easily exploitable. This designation implies that the attack path requires no specialized conditions, custom tooling, or knowledge of internal state. The scope is unchanged, meaning the impact remains within the vulnerable component boundary but covers all data accessible to that component.

Root Cause

Oracle has not published component-level technical details beyond the advisory. The combination of PR:N (no privileges required) and AC:L (low complexity) with confidentiality and integrity impact is consistent with either broken access control on a Product Quality Management endpoint or an injection-class flaw that permits arbitrary data operations. Refer to the Oracle Security Alert July 2026 for authoritative details.

Attack Vector

The attack vector is network-based over HTTP. An attacker sends crafted requests to an exposed Oracle Agile PLM for Process 6.2.4 instance and interacts with the Product Quality Management component. Because authentication is not required, any network-reachable deployment, including internal deployments accessible to a foothold host, is in scope. No exploit code or proof of concept has been published, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-61184

Indicators of Compromise

Unauthenticated HTTP requests to Product Quality Management endpoints originating from unexpected source addresses
Anomalous create, update, or delete operations on quality management records outside normal business hours
Unexpected exports or bulk reads of PLM data from application logs

Detection Strategies

Review Oracle Agile PLM for Process application logs for HTTP requests to Product Quality Management URIs lacking an authenticated session context
Correlate web server access logs with application-tier audit trails to identify mismatched sessions or missing user identifiers
Baseline normal PLM API call volumes and alert on statistical deviations in record modification rates

Monitoring Recommendations

Forward Oracle Agile PLM for Process web tier, application, and database audit logs to a centralized SIEM
Enable database-level auditing on Product Quality Management tables to record row-level create, update, and delete events
Monitor perimeter and internal network flows for direct HTTP access to the PLM application from non-approved subnets

How to Mitigate CVE-2026-61184

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update fixes for Oracle Agile Product Lifecycle Management for Process without delay
Inventory all Oracle Agile PLM for Process 6.2.4 deployments, including test and staging environments
Restrict network access to the PLM application to authenticated users through VPN, allowlisted subnets, or a reverse proxy enforcing authentication
Rotate credentials and review audit logs for any suspicious activity predating patch deployment

Patch Information

Oracle published fixes in the July 2026 Critical Patch Update. Administrators should consult the Oracle Security Alert July 2026 for the exact patch identifiers and installation instructions applicable to Oracle Agile Product Lifecycle Management for Process 6.2.4.

Workarounds

Place the PLM application behind a web application firewall configured to block unauthenticated requests to Product Quality Management endpoints
Enforce network segmentation so that only authorized workstations and integration services can reach the application over HTTP
Disable or restrict any Product Quality Management interfaces not required for business operations until the patch is applied

bash

# Example: restrict HTTP access to the PLM application at the reverse proxy
# nginx snippet - allow only internal subnets to reach the PLM host
location / {
    allow 10.0.0.0/8;
    allow 192.168.10.0/24;
    deny all;
    proxy_pass http://oracle-agile-plm-backend;
}