CVE-2026-61185: Oracle Agile PLM Auth Bypass Vulnerability

CVE-2026-61185 Overview

CVE-2026-61185 is a high-severity vulnerability in Oracle Agile Product Lifecycle Management (PLM) for Process, part of the Oracle Supply Chain suite. The flaw resides in the Installation component of version 6.2.4. An unauthenticated attacker with access to the adjacent physical communication segment can compromise the application without user interaction. Successful exploitation exposes all data accessible to Oracle Agile PLM for Process and produces a scope change that can affect additional products. Oracle disclosed the issue in the July 2026 Critical Patch Update.

Critical Impact
Adjacent-network attackers can obtain unauthorized read access to all data managed by Oracle Agile PLM for Process, with impact extending beyond the vulnerable component.

Affected Products

Oracle Agile Product Lifecycle Management for Process 6.2.4
Oracle Supply Chain product family
Deployments where the PLM host is reachable on the local physical network segment

Discovery Timeline

2026-07-21 - CVE CVE-2026-61185 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Addressed in the Oracle Security Alert July 2026

Technical Details for CVE-2026-61185

Vulnerability Analysis

The vulnerability affects the Installation component of Oracle Agile PLM for Process 6.2.4. Oracle classifies the issue as easily exploitable, requiring no authentication and no user interaction. The attack vector is adjacent, meaning the attacker must reside on the same physical communication segment as the target host. Impact is limited to confidentiality, but the scope changes when the flaw is triggered. A successful attack yields access to all data the PLM application can reach, including data belonging to integrated downstream products.

Root Cause

Oracle has not published the underlying technical root cause. The issue is located within installation-time logic that exposes sensitive resources over an adjacent network path. Because exploitation does not require privileges or credentials, the affected code path lacks sufficient authentication or transport controls when handling requests originating from the local segment. Consult the Oracle Security Alert July 2026 for vendor-specific advisory details.

Attack Vector

An attacker positioned on the same layer-2 broadcast domain as the Oracle Agile PLM for Process host sends crafted traffic to the vulnerable service. Because the CVSS vector specifies AV:A/PR:N/UI:N, exploitation requires only network adjacency, not remote reachability or user cooperation. The scope change (S:C) indicates the compromise crosses the security boundary of the vulnerable component and can read data owned by integrated systems. No public proof-of-concept exploit is available at the time of publication.

Detection Methods for CVE-2026-61185

Indicators of Compromise

Anomalous inbound connections to the Oracle Agile PLM for Process host originating from unmanaged devices on the same VLAN.
Unexpected bulk reads or exports from PLM data stores outside standard business hours.
Access to installation-time endpoints or configuration services after the product has entered normal operation.

Detection Strategies

Baseline expected client subnets that communicate with the PLM server and alert on new adjacent-segment sources.
Inspect application and web-server access logs for unauthenticated requests to installer or setup routes.
Correlate PLM audit logs with network flow data to identify data egress that does not match authenticated user sessions.

Monitoring Recommendations

Enable verbose logging on the Oracle Agile PLM for Process application server, including request-level auditing.
Forward host, application, and network telemetry to a centralized analytics platform for cross-source correlation.
Monitor VLAN segmentation and switch port ACLs for unauthorized devices joining the PLM network segment.

How to Mitigate CVE-2026-61185

Immediate Actions Required

Apply the fixes contained in the Oracle Security Alert July 2026 to all Oracle Agile PLM for Process 6.2.4 deployments.
Restrict the PLM host to a dedicated, tightly controlled VLAN and remove untrusted devices from that segment.
Audit recent access logs for reads from adjacent-network sources that lack corresponding authentication events.

Patch Information

Oracle released remediation as part of the July 2026 Critical Patch Update. Administrators should download and apply the vendor-supplied patch that addresses CVE-2026-61185 in the Installation component of Oracle Agile Product Lifecycle Management for Process 6.2.4. Refer to the Oracle Security Alert July 2026 for patch identifiers and installation prerequisites.

Workarounds

Enforce network segmentation so that only authorized administrative hosts share a physical or virtual segment with the PLM server.
Disable or firewall installation and setup services once the product is deployed in production.
Require 802.1X or equivalent port-based authentication on switches that serve PLM infrastructure.
Terminate PLM traffic through a reverse proxy that enforces client authentication before requests reach the application.