This vulnerability affects Oracle Agile PLM version 9.3.6 in the Security component of Oracle Supply Chain. An unauthenticated attacker with network access via HTTP can exploit this vulnerability, which is rated with a CVSS 3.1 base score of 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N). Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or complete access to all Oracle Agile PLM accessible data. The vulnerability is difficult to exploit and does not impact availability. Oracle's July 2026 Critical Patch Update advisory references Oracle Agile PLM 9.3.6 among affected products but does not explicitly confirm patch availability or remediation status for this CVE.

The vulnerability allows unauthorized attackers to compromise Oracle Agile PLM 9.3.6 remotely over HTTP without authentication, resulting in high confidentiality and integrity impacts. Attackers may create, delete, or modify critical data or gain complete access to all data accessible by Oracle Agile PLM. There is no impact on availability. No known exploits in the wild have been reported at this time.

Oracle's July 2026 Critical Patch Update advisory includes Oracle Agile PLM 9.3.6 among affected products, indicating that patches addressing security vulnerabilities have been released. However, the advisory does not explicitly confirm a patch for CVE-2026-61173. Customers are strongly advised to review the official Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and apply all relevant security patches promptly. Until a confirmed patch is applied, organizations should restrict network access to Oracle Agile PLM HTTP interfaces to trusted users and monitor for unusual activity. Patch status is not yet confirmed for this specific vulnerability—check the vendor advisory for current remediation guidance.