CVE-2026-61182

Analyzed Analyzed - Analysis Complete

Privilege Escalation in Oracle Agile PLM for Process

Publication date: 2026-07-21

Last updated on: 2026-08-01

Assigner: Oracle

Description

Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Data Import). The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Agile Product Lifecycle Management for Process executes to compromise Oracle Agile Product Lifecycle Management for Process. Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-08-01

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-09

NVD

CVE-2026-61182

EUVD

EUVD-2026-47389

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	agile_product_lifecycle_management_for_process	6.2.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Agile Product Lifecycle Management for Process version 6.2.4. It allows a high-privileged attacker with local system access to take over the application. The vulnerability has a CVSS score of 6.7, indicating impacts on confidentiality, integrity, and availability.

Detection Guidance

Detection of this vulnerability requires checking for the affected Oracle Agile Product Lifecycle Management for Process version 6.2.4. Review system logs for unauthorized access attempts or unusual activity in the Data Import component. Ensure the software version is verified against the affected release.

Impact Analysis

An attacker could gain full control of the Oracle Agile Product Lifecycle Management for Process system, potentially leading to data theft, unauthorized modifications, or system disruption. This requires the attacker to already have high privileges and local access.

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data, which may violate compliance requirements under GDPR or HIPAA. Organizations using this software should assess potential risks to data protection and regulatory adherence.

Mitigation Strategies

Apply the latest security patches or updates from Oracle to address this vulnerability. Restrict user privileges to minimize access to the Data Import component. Monitor system activity for suspicious behavior and consider isolating the affected system if necessary.

Hi! I’m here to help you understand CVE-2026-61182. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70