Oracle Agile EDM CVE-2026-101746

Exploitation requires the attacker to have access to the adjacent physical/logical communication segment attached to the hardware where Oracle Agile Engineering Data Management 6.2.1 runs (AV:A) - it is NOT exploitable from an arbitrary remote/internet location. Additionally, successful attacks require human interaction from a person other than the attacker (UI:R), meaning a legitimate user or operator must perform some triggering action. No authentication is needed (PR:N) and complexity is low (AC:L). The combined limiting factors - same-segment network adjacency plus required third-party user interaction - substantially narrow realistic exploitation to environments where untrusted devices share the LAN with the EDM host.

This is a genuinely serious but access-constrained flaw whose real-world risk sits below its 7.3 CVSS score for most environments. The CVSS vector confirms the key limiting factor: AV:A means the attacker must be on the adjacent/physical communication segment attached to the host (not routable from the internet), and UI:R means a separate human must perform some action for the attack to succeed. Offsetting those constraints, AC:L (low complexity) and PR:N (no authentication) make exploitation easy once network adjacency is achieved, and C:H/I:H give high confidentiality and integrity impact (full read plus create/delete/modify of all accessible data). No EPSS score, KEV listing, or public POC was provided, so there is no evidence of active or imminent exploitation; the absence of these signals plus the adjacent-network requirement argues against mass exploitation. Note a tagging conflict: the input Tags include 'Authentication Bypass,' but nothing in the Oracle description describes an authentication-bypass mechanism - the flaw is an unauthenticated adjacent-network attack requiring user interaction, so treat that tag as unverified. Net: patch in the normal Oracle CPU cycle; this is not an emergency for internet-exposed assets but matters where untrusted devices share the LAN segment with the EDM host.

An attacker with a foothold on the same local network segment as the Oracle Agile Engineering Data Management server (e.g., a compromised workstation or rogue device on the LAN) stages a malicious payload or crafted content and waits for a legitimate user or operator to interact with it. That human interaction triggers the flaw, giving the unauthenticated attacker full read and write access to all EDM-accessible engineering data. No public exploit code was identified at time of analysis.