This vulnerability affects Oracle Agile PLM version 9.3.6 and involves a security flaw in the product's security component that can be exploited remotely without authentication over HTTP. Successful exploitation can result in unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by Oracle Agile PLM. The CVSS 3.1 base score is 7.4, reflecting high confidentiality and integrity impacts with no availability impact. The vulnerability is classified under CWE-284 (Improper Access Control). The vendor advisory from Oracle's July 2026 Critical Patch Update mentions Oracle Agile PLM 9.3.6 among affected products but does not explicitly confirm a patch for this specific CVE in the provided text. Oracle urges customers to apply available patches without delay to mitigate such vulnerabilities.

An unauthenticated attacker with network access via HTTP could exploit this vulnerability to gain unauthorized creation, deletion, or modification privileges on critical data within Oracle Agile PLM 9.3.6. This could lead to unauthorized access to sensitive or critical data or complete compromise of all data accessible through Oracle Agile PLM. The impact affects confidentiality and integrity but does not affect availability. There are no known exploits in the wild currently.

The vendor advisory references the July 2026 Critical Patch Update, which includes patches for Oracle Agile PLM 9.3.6 among many other products. Although the advisory does not explicitly confirm a patch for CVE-2026-61173, Oracle strongly recommends applying the latest Critical Patch Update promptly to mitigate this and other vulnerabilities. Patch status is not explicitly confirmed for this CVE in the advisory; therefore, users should verify patch availability and apply updates as soon as possible by consulting the official Oracle Critical Patch Update documentation at https://www.oracle.com/security-alerts/cpujul2026.html.