What is the CVSS score of CVE-2026-61187?

CVE-2026-61187 has a CVSS 3.1 base score of 2.8 (Low). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.1%.

Oracle Agile EDM CVE-2026-61187

EUVD-2026-47394 LOW

Improper Resource Shutdown or Release (CWE-404)

2026-07-21 secalert_us@oracle.com

GHSA-vf43-wq9f-8h4p

Oracle Denial Of Service Agile Engineering Data Management

2.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

2.8 LOW

AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L

vuln.today AI

2.8 LOW

Local attack vector with low privilege and required third-party interaction; only partial availability impact with no confidentiality or integrity effect confirmed by description.

3.1 AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L

4.0 AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:17 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Install). The supported version that is affected is 6.2.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Agile Engineering Data Management executes to compromise Oracle Agile Engineering Data Management. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Agile Engineering Data Management. CVSS 3.1 Base Score 2.8 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L).

AnalysisAI

Partial denial-of-service exposure in Oracle Agile Engineering Data Management 6.2.1 allows a local, low-privileged attacker to degrade availability of the Install component when a separate user interacts with the system. The CVSS 3.1 base score of 2.8 reflects the constrained impact: only availability is affected, no confidentiality or integrity loss occurs, and exploitation is bounded by local access and mandatory human interaction from a third party. No public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

The vulnerability resides in the Install component of Oracle Agile Engineering Data Management (EDM) 6.2.1, a product within Oracle's Supply Chain suite used for managing engineering and product data in manufacturing contexts. The CWE is not disclosed by Oracle, which is consistent with their standard advisory practice of withholding root-cause detail. The CVSS vector (AV:L/AC:L/PR:L/UI:R/S:U) indicates the flaw is exercised locally on the infrastructure host where the EDM application runs, requires only low OS-level privileges, and depends on a second user interacting with the system - a pattern typical of race conditions, insecure temporary file handling, or local privilege misuse during installation routines. The scope is unchanged (S:U), meaning exploitation cannot cross a security boundary to affect other components.

RemediationAI

Apply the Oracle Critical Patch Update released July 2026, available via the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html. An exact fixed version number is not independently confirmed from the available data beyond the CPU advisory reference - organizations should consult the Oracle CPU documentation for the precise patch identifier. Patch available per vendor advisory. As a compensating control pending patching, restrict local logon access to the EDM host to the minimum set of required service accounts, reducing the pool of potential low-privileged local attackers. Because exploitation also requires human interaction from a separate user, limiting interactive sessions on the EDM infrastructure host further constrains the attack surface with minimal operational trade-off.