Oracle Agile EDM CVE-2026-61189

Exploitation requires a valid OS-level logon to the host infrastructure where Oracle Agile Engineering Data Management 6.2.1 is installed - the attacker must be a low-privileged local user (PR:L, AV:L confirmed by CVSS vector). No user interaction from a privileged user is required (UI:N). The vulnerability is specifically in the Install component, meaning exploitation likely depends on conditions established by the installation process (e.g., insecure file permissions, readable config files, or bypass-enabling artifacts left on disk). The 'Authentication Bypass' tag suggests the low-privileged OS user can circumvent EDM's application-layer authentication without valid EDM credentials. Exploitation is limited by the requirement for local infrastructure access - remote unauthenticated exploitation is not indicated by the AV:L vector. Integrity and availability are not impacted (I:N, A:N), constraining the attack to data theft rather than modification or disruption.

The CVSS 3.1 base score of 6.5 is moderate in isolation, but the real-world risk profile warrants closer attention for affected deployments. The AV:L vector requires local logon to the EDM host, which is a meaningful prerequisite that limits internet-exposed mass exploitation - however, in enterprise environments, many users or service accounts may legitimately have this level of access. AC:L and UI:N mean no additional conditions or victim cooperation are needed once local access is established, keeping the exploitation bar low for any insider or compromised account. The S:C (scope change) with C:H is the most consequential signal: successful exploitation can expose critical or complete EDM data and spill over into additional Oracle Supply Chain products, amplifying the blast radius well beyond a single application. The 'Authentication Bypass' tag suggests the attacker may escalate from low-privilege OS access to elevated application-layer access without valid EDM credentials. No EPSS data was provided in the input, no KEV listing exists, and no POC is publicly known - exploitation probability therefore appears low in absolute terms but is non-trivial for any organization with untrusted local users on EDM infrastructure. The absence of a CWE designation limits confidence in root-cause analysis.

An attacker with a low-privileged OS account on the EDM application server - such as a disgruntled employee, a compromised service account, or a lateral-movement foothold - leverages a weakness introduced by the EDM installer to bypass the application's authentication controls and read data stores they are not authorized to access, potentially including engineering BOMs, product configurations, and supply chain records. The scope change means the same weakness may expose credentials or configuration files readable by other Oracle Supply Chain components co-hosted or sharing a credential store with EDM. No public POC code is known at time of analysis.