Oracle Agile eDM CVE-2026-61186

The affected surface is the 'Install' component of Oracle Agile Engineering Data Management 6.2.1 reachable via HTTP; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) there are no special conditions - remote unauthenticated exploitation is possible over the network against version 6.2.1 without user interaction. The practical limiting factor is exposure: the eDM HTTP application/Install tier must be network-reachable by the attacker, so deployments that keep this interface on isolated internal networks or behind a VPN substantially reduce realistic risk. Exploitation is constrained to the stated supported affected version, 6.2.1.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H, base 9.4) indicates a low-complexity, unauthenticated, network-exploitable issue with high integrity and availability impact and only limited confidentiality impact - a high-priority profile on paper, and Oracle's 'easily exploitable' wording reinforces the low attack complexity. Counterbalancing signals: no EPSS score was provided, the CVE is not in CISA KEV (no confirmed active exploitation), and no public POC has been identified, so exploitation is currently theoretical rather than demonstrated. Real-world risk is therefore bounded by the product's niche deployment footprint and by whether the HTTP/Install tier is actually network-exposed. The signals are not internally conflicting; the key gaps are the missing CWE and the absence of independent exploitation intelligence.

An attacker with only network access sends crafted HTTP requests to the exposed Oracle Agile eDM application, reaching the vulnerable Install component without authenticating. They then modify or delete critical engineering/PLM records, read a subset of accessible data, or repeatedly crash the service for a complete denial of service. No public POC has been identified, but Oracle characterizes exploitation as easy and low-complexity.