External risk intelligence

Oracle Agile PLM Security Vulnerability Allows Unauthorized Data Access

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-61171

Oracle Agile PLM is an enterprise application typically deployed within internal corporate networks to manage product lifecycles. While it utilizes HTTP/web interfaces and can be reachable from the internet in some specific organizational deployments, it is not a service designed to be public-facing by default, nor is it typically positioned as an edge gateway or public-facing portal.

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in Oracle Agile PLM software could allow an attacker to access or alter critical business data without authorization. This issue, rated as critical, affects how sensitive product lifecycle information is protected. The primary concern is confirming if this specific Oracle product is in use and if it is exposed to potential compromise.

Unauthenticated attackers can exploit this to access or modify sensitive data.
Safeguards enterprise product lifecycle and critical data.
Confirm relevance and exposure of Oracle Agile PLM.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by accessing the Oracle Agile PLM product over a network. Since no authentication is required, an unauthenticated attacker can send malicious requests via HTTP to compromise the system. This could lead to unauthorized changes or access to sensitive data within the product.

No authentication needed for network access.
Compromise via HTTP requests.
Unauthorized data access or modification.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated attacker with network access could compromise Oracle Agile PLM, potentially leading to unauthorized modification or access of critical or all accessible data. This vulnerability affects the Oracle Agile PLM product, version 9.3.6, when accessible via HTTP.

Critical Oracle Agile PLM data.
Network access can expose data.
Unauthorized data modification or access.

Operational Fix

Recommended remediation, mitigation, and detection steps

Given this vulnerability in Oracle Agile PLM, the application owner is primarily responsible for remediation, with support from infrastructure and security teams. The first practical step is to inventory all Oracle Agile PLM instances, determine their exposure, confirm business criticality, and identify the accountable owner to plan a risk-based remediation strategy.

Application owners should manage the issue.
Verify instance exposure and criticality first.
Plan coordinated vendor-assisted remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Oracle Agile PLM?

Oracle Agile PLM is an enterprise software platform used by organizations to manage product lifecycles, including engineering data, design changes, and manufacturing requirements. It acts as a centralized repository for sensitive business information throughout the development process. The affected version is 9.3.6.

How does CVE-2026-61171 affect system security?

This vulnerability acts as a security bypass that allows an unauthenticated user to interact with the application as if they were a logged-in user. It removes the requirement for valid credentials, permitting unauthorized parties to read, change, or delete the sensitive design and product data stored within the system.

Do I need to be authenticated to trigger this vulnerability?

No, authentication is not required to trigger the issue. An attacker only needs network access to the system to send malicious HTTP requests. This bug is not triggered by actions occurring entirely within the local host environment, as it specifically relies on network-based communication to reach the application's interface.

Is my Oracle Agile PLM instance at risk?

According to Halo Surface Signal, this software is typically deployed within internal corporate networks and is not designed to be public-facing. Risk is highest if your instance is reachable from the internet. You should determine if your deployment is restricted to internal users or if it has been exposed via a web gateway, as that significantly changes the potential reach of an attacker.

What should I do first to address this CVE?

Begin by creating a comprehensive inventory of all Oracle Agile PLM 9.3.6 instances running in your environment. Confirm the business criticality of each instance and identify the accountable owners. Once you have a clear picture of where the software resides, work with your infrastructure and security teams to verify its network exposure and coordinate official vendor-provided remediation steps.

References

www.oracle.com/security-alerts/cpujul2026.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.