Oracle Agile EDM CVE-2026-61187

Exploitation requires three concurrent conditions: the attacker must have a local logon session on the host where Oracle Agile EDM 6.2.1 executes (AV:L, PR:L), the affected version 6.2.1 must be deployed, and a separate person other than the attacker must actively interact with the Install component at the time of the attack (UI:R). Exploitation is limited to a partial availability impact only - there is no path to confidentiality or integrity compromise. The requirement for human interaction from a third party is the primary limiting factor beyond local access, as it prevents fully automated or opportunistic exploitation.

The aggregate risk picture for this vulnerability is very low. The CVSS 3.1 base score of 2.8 is near the floor of the scoring scale, driven by a local attack vector (AV:L), low required privileges (PR:L), mandatory human interaction from a party other than the attacker (UI:R), unchanged scope (S:U), and impact limited to partial availability (A:L) with no confidentiality or integrity effect (C:N/I:N). There is no CISA KEV listing, no published proof-of-concept, and no EPSS data surfaced in the available intelligence. The dependency on human interaction from a third party substantially narrows exploitability in practice, as the attacker must coordinate or wait for an independent user action. This vulnerability is unlikely to rise to priority patching status in most environments except those with zero-tolerance availability requirements for EDM services. No conflicting signals are present in the available data; the CVSS vector and description are internally consistent.

A low-privileged local user with a logon session on the EDM infrastructure host waits for or induces a second user (such as an administrator running an install or maintenance task) to interact with the Install component. During that interaction window, the attacker triggers a condition that causes a partial availability disruption to the EDM service. No public exploit code exists at time of analysis, making opportunistic exploitation unlikely.