Oracle Agile PLM Vulnerabilities 2024–2025 and Beyond

Reading Time: 5 minutes

August 2026 update: This article has been revised to include Oracle’s January, June, and July 2026 security releases.

Oracle’s July 2026 Update Changes the Risk Picture

Oracle’s July 21, 2026 Critical Patch Update addresses 11 vulnerabilities directly affecting Oracle Agile PLM 9.3.6. Eight can be exploited remotely without authentication. The potential effects include complete application takeover, access to critical or all accessible Agile data, and unauthorized modification or deletion of that data.

That release followed a June 2026 out-of-cycle patch for CVE-2026-46859, a CVSS 9.8 vulnerability that Oracle says could allow an unauthenticated attacker to take over Agile PLM through HTTP. The June patch also addresses CVE-2026-21940, which Oracle disclosed in January 2026.

From January 2025 through July 2026, Oracle advisories addressed 24 distinct vulnerabilities specifically affecting Agile PLM or Agile PLM Framework 9.3.6. That count excludes broader WebLogic, database, Java, and infrastructure vulnerabilities unless Oracle listed Agile PLM itself as affected.

The 11 Agile PLM Vulnerabilities Added in July 2026

The patch list is less like one broken lock and more like an inspection report identifying weaknesses across several doors and windows. The highest-priority items are the unauthenticated takeover and broad data-access vulnerabilities.

CVE	CVSS	Access required	Potential result
CVE-2026-61167	9.8 Critical	None; remote HTTP	Complete Agile PLM takeover
CVE-2026-61171	9.1 Critical	None; remote HTTP	Read, create, change, or delete critical data
CVE-2026-61166	8.8 High	Low-privileged account	Complete Agile PLM takeover
CVE-2026-61168	8.8 High	Low-privileged account	Complete Agile PLM takeover
CVE-2026-61170	8.1 High	None; higher complexity	Complete Agile PLM takeover
CVE-2026-34487	7.5 High	None; remote HTTP	Access to critical or all accessible data
CVE-2026-61172	7.5 High	None; remote HTTP	Access to critical or all accessible data
CVE-2026-61173	7.4 High	None; higher complexity	Read or modify critical or all accessible data
CVE-2026-47009	6.5 Medium	None; user interaction required	Access to critical or all accessible data
CVE-2026-61169	6.5 Medium	Local low-privileged access	Access to critical or all accessible data
CVE-2025-68161	4.8 Medium	None; higher complexity	Limited unauthorized data access or modification

Source: Oracle July 2026 Critical Patch Update

The Pattern Did Not Begin in July

The two vulnerabilities highlighted in the original version of this article remain important. CVE-2024-20953 and CVE-2024-21287 are both included in CISA’s Known Exploited Vulnerabilities catalog, meaning exploitation has been observed outside a laboratory setting. The dates and newer disclosures now need to be placed in the correct sequence.

Release	Agile disclosure	What it changed
January 2024	CVE-2024-20953	CVSS 9.9. A low-privileged remote attacker could take over Agile PLM. CISA later added it to the KEV catalog.
November 2024	CVE-2024-21287	Unauthenticated file disclosure. Oracle issued a separate security alert, and CISA added it to the KEV catalog.
January 2025	Four Agile PLM Framework CVEs	Integration Services, SDK, and installation weaknesses with scores ranging from 6.5 to 9.9.
July 2025	Three Agile PLM CVEs	Included two unauthenticated Apache Tomcat vulnerabilities capable of Agile PLM takeover.
January 2026	Five Agile PLM CVEs	Potential effects included data modification, takeover, denial of service, and access to critical data.
June 2026	CVE-2026-46859	CVSS 9.8. Unauthenticated remote takeover; the patch also addresses CVE-2026-21940.
July 2026	Eleven Agile PLM CVEs	Eight remotely exploitable without authentication, including takeover and broad data-access flaws.

Agile PLM Security Has More Than One Layer

An Agile security review cannot stop at the application version. Most environments include several connected layers, and each can have a separate patch history. Repairing the application while overlooking the supporting stack is like replacing the front-door lock while leaving the windows unexamined.

Agile application: Security, User and User Group, Document Management, and Folders, Files and Attachments components.
Application infrastructure: WebLogic Server, Java, Tomcat-based services, File Manager, and related libraries.
Connected products: AutoVue, database components, authentication services, integrations, SDK applications, and process extensions.

Installing an Agile patch does not automatically prove that every supporting component is current. Teams need a documented baseline showing the installed Agile RUP, applicable CPUs, component versions, patch dates, test evidence, and exceptions.

Are Versions Earlier Than Agile PLM 9.3.6 Affected?

Oracle’s 2026 risk matrices identify Agile PLM 9.3.6 because it is the supported release Oracle evaluated. Oracle states that releases outside Premier or Extended Support are not tested for these vulnerabilities, but earlier releases are likely affected. An older Agile version should not be treated as safe simply because it is absent from the affected-version column.

What Agile PLM Teams Should Do Now

Establish the patch baseline. Record the Agile version and RUP, June and July 2026 security updates, WebLogic, database, Java, File Manager, AutoVue, and relevant third-party libraries.
Verify the Oracle patch path. Use Oracle’s Patch Availability Documents and My Oracle Support instructions to confirm prerequisites, supersedence, installation order, and whether earlier CPUs were skipped.
Reduce unnecessary exposure. Review externally reachable HTTP endpoints, administrative interfaces, service accounts, remote-access paths, and network segmentation. Compensating controls reduce risk but do not replace patching.
Test the workflows most likely to be affected. Prioritize authentication, user and group administration, file uploads and downloads, document management, integrations, SDK applications, SSO, process extensions, and audit logging. Maintain a tested rollback plan.
Review evidence of possible misuse. Check authentication events, user and group changes, unusual file access, unexpected administrative activity, and web or application logs. Environments that missed the KEV-related fixes deserve additional scrutiny.
Connect patching to the 2027 roadmap. Patching protects the current environment while Oracle support remains available. It does not eliminate the time required to clean data, replace integrations, validate a new platform, and train users before Premier Support ends in December 2027.

Does This Mean Every Agile Customer Must Migrate Immediately?

No. A new vulnerability does not automatically require immediate PLM replacement. Organizations with current patches, restricted exposure, disciplined monitoring, and a supported configuration may be able to operate Agile responsibly while executing a planned transition.

What the 2026 disclosures change is the cost of uncertainty. If your team cannot quickly confirm which patches are installed, which endpoints are exposed, or which components are unsupported, your organization does not yet have a defensible view of its Oracle Agile PLM security risk.

For the longer-term planning side, see the Agile PLM migration guide and why third-party support is a bridge rather than a product roadmap.

Security Risk Is Also a PLM Governance Issue

“Security threats like this reinforce why we have been advising our clients to assess their long-term PLM strategy. It is not just about fixing today’s problem; it is about ensuring your IP remains protected for the future.”

– Randy Pettit, President, Domain Systems

The immediate goal is not to turn every PLM owner into a security engineer. It is to make ownership visible: who tracks Oracle advisories, who validates applicability, who approves downtime, who tests regulated workflows, and who documents the result. Without those answers, quarterly patching becomes a recurring emergency instead of a controlled process.

Know Your Current Position

Do you know which Agile, File Manager, WebLogic, Java, database, and AutoVue patches are installed? Domain Systems can help document the current environment, identify gaps, prioritize remediation, and connect short-term support decisions to a practical modernization roadmap.

Schedule an Agile PLM readiness review.

Considering Propel Software?

Download our Agile-to-Propel Migration Guide for a step-by-step framework covering migration planning, data preparation, integrations, validation, and cutover.

FAQ

Is Oracle Agile PLM still secure to operate in 2026?

Security depends on version, patch status, configuration, exposure, and monitoring. Oracle continues to issue fixes for supported Agile PLM 9.3.6 environments. Running without current patches or without a documented patch baseline creates materially greater risk.

Which Agile PLM version is affected by the July 2026 vulnerabilities?

Oracle lists Agile PLM 9.3.6 as affected. Earlier unsupported releases are not tested, but Oracle warns that earlier versions of affected releases are likely vulnerable as well.

Does installing the latest Agile patch also patch WebLogic and the database?

Not necessarily. Agile, WebLogic, database, Java, AutoVue, and other supporting components can have separate patch requirements. Confirm the complete stack against Oracle’s Patch Availability Documents and the environment’s installed versions.

Do the 2026 vulnerabilities mean an Agile migration must begin immediately?

They make immediate risk verification necessary. Migration timing still depends on business requirements, data complexity, integrations, validation needs, resources, and the organization’s ability to operate the current environment safely through the remaining support period.