EUVD-2026-47396
GHSA-cw4c-49h8-q2xf
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Local vector confirmed by description; PR:L reflects required infrastructure logon; S:C and C:H reflect scope change with critical data exposure; no integrity or availability impact.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Install). The supported version that is affected is 6.2.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Agile Engineering Data Management executes to compromise Oracle Agile Engineering Data Management. While the vulnerability is in Oracle Agile Engineering Data Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Agile Engineering Data Management accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).
AnalysisAI
Unauthorized critical data disclosure in Oracle Agile Engineering Data Management 6.2.1 is achievable by a low-privileged attacker with local infrastructure access, exploiting a weakness in the Install component to bypass authentication controls and reach protected data. The scope change (S:C) means successful exploitation can cascade into unauthorized access across additional Oracle Supply Chain products beyond EDM itself. No public exploit code or CISA KEV listing exists at time of analysis, but the low attack complexity and absence of user interaction make this straightforward to exploit given local footing.
Technical ContextAI
Oracle Agile Engineering Data Management (EDM) is an enterprise PLM/PDM platform used in manufacturing and supply chain environments for managing engineering bills of materials, change management, and product lifecycle data within Oracle's Supply Chain suite. The vulnerable component is 'Install,' suggesting the weakness resides in the installation or deployment mechanism - commonly a source of insecure file permissions, world-readable configuration files containing credentials, or hardcoded secrets written during the install process. The 'Authentication Bypass' tag indicates that despite the attacker requiring initial infrastructure logon (PR:L, AV:L), a subsequent authentication control within EDM can be circumvented, granting access beyond the attacker's authorized scope. The CWE is not specified (N/A), which limits root-cause classification, but the combination of Install component, authentication bypass, and scope change suggests a configuration or file-permission flaw rather than a memory-safety issue. The CVSS scope change (S:C) signals that the compromised component can affect the security boundary of adjacent Oracle Supply Chain products sharing the same infrastructure or credential store.
RemediationAI
Apply the patch issued as part of the Oracle Critical Patch Update for July 2026, available via the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html. The exact patched version number is not independently specified beyond the CPU advisory reference - consult Oracle Support for the precise patch ID or updated build for EDM 6.2.1. As a compensating control pending patch application, restrict local logon access to the EDM infrastructure to only those accounts strictly required for operations, removing any unnecessary low-privileged user accounts from the host. Audit file and directory permissions created by the EDM installer for world-readable or group-readable files containing credentials or configuration secrets, and restrict these to the EDM service account only. Network segmentation of the EDM host reduces lateral movement risk in the event of scope-changed compromise to adjacent Oracle Supply Chain components. Note that file permission hardening may require re-validation after patching if the installer re-creates affected paths.
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Rate
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8
The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to
When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a)
In OpenSSL 1.1.0 before 1.1.0d, if a malicious server supplies bad parameters for a DHE or ECDHE key exchange then this
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursio
An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release
Vulnerability in the Advanced Networking Option component of Oracle Database Server. Rated high severity (CVSS 8.3), thi
A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2
In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "/
Unspecified vulnerability in the Oracle Agile Engineering Data Management component in Oracle Supply Chain Products Suit
A vulnerability was found in Hibernate-Validator. Rated medium severity (CVSS 6.1), this vulnerability is remotely explo
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today