This vulnerability affects Oracle Agile PLM version 9.3.6 and is classified under CWE-306 (Missing Authentication for Critical Function) and CWE-284 (Improper Access Control). It allows an unauthenticated attacker with network access via HTTP to perform unauthorized actions including creation, deletion, or modification of critical data, or gain unauthorized access to all data accessible by Oracle Agile PLM. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts. Oracle's July 2026 Critical Patch Update advisory references multiple patches across products but does not explicitly confirm a patch for this vulnerability. Customers are advised to review the advisory and apply relevant patches promptly.

Successful exploitation results in unauthorized creation, deletion, or modification of critical data or complete unauthorized access to all data accessible by Oracle Agile PLM. This compromises confidentiality and integrity of the system's data but does not impact availability. The vulnerability is exploitable remotely without authentication, increasing risk severity.

Oracle has released a Critical Patch Update advisory in July 2026 covering multiple vulnerabilities. However, the advisory does not explicitly confirm a patch for CVE-2026-61171. Customers should consult the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and apply all relevant patches promptly. Until a patch is confirmed and applied, restrict network access to Oracle Agile PLM 9.3.6 instances to trusted users only and monitor for unusual activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.