EUVD-2026-47397
GHSA-j4pj-xjh3-5j6w
Severity by source
AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N
Network vector confirmed via HTTP; AC:H reflects bypass complexity requiring victim interaction; PR:L for low-privilege attacker; no availability impact per description.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Install). The supported version that is affected is 6.2.1. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Engineering Data Management. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Agile Engineering Data Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Agile Engineering Data Management accessible data. CVSS 3.1 Base Score 6.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N).
AnalysisAI
Oracle Agile Engineering Data Management 6.2.1 contains an authentication bypass in its Install component, reachable over HTTP by low-privileged network attackers, that enables complete unauthorized read and write access to all application data. Exploitation requires both high attack complexity and active human interaction from a victim - limiting opportunistic exploitation - but successful attacks yield critical confidentiality and integrity compromise with no availability impact. No public exploit has been identified at time of analysis; Oracle addressed this in the Critical Patch Update for July 2026.
Technical ContextAI
Oracle Agile Engineering Data Management is a specialized enterprise product lifecycle management (PLM) and engineering data management (PDM) platform used in supply chain and manufacturing environments to manage bills of materials, parts, and related engineering documentation. The affected component is 'Install,' which is part of the installation or configuration infrastructure of the product. The 'Authentication Bypass' tag indicates that the flaw likely resides in authentication or session validation logic within this component when accessed over HTTP. No CWE has been formally assigned, but authentication bypass vulnerabilities typically fall under CWE-287 (Improper Authentication) or CWE-306 (Missing Authentication for Critical Function). The affected version is exclusively 6.2.1, as confirmed by Oracle's July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html.
RemediationAI
Apply Oracle's Critical Patch Update for July 2026 by following Oracle's patch guidance at https://www.oracle.com/security-alerts/cpujul2026.html. An exact patched version number beyond inclusion in the July 2026 CPU is not independently confirmed from available data - consult Oracle's My Oracle Support and the CPU advisory directly to obtain the specific patch artifact for Agile Engineering Data Management 6.2.1. As a compensating control while patching is pending, restrict HTTP access to the Install component at the network layer (firewall or reverse-proxy ACL) to only trusted administrative IP ranges, which directly limits the AV:N attack surface. Additionally, enforce least-privilege principles on accounts with access to the Install component and monitor for anomalous authentication events in Agile EDM logs. Note that restricting Install component access may impact legitimate installation or reconfiguration workflows and should be coordinated with application administrators.
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Rate
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8
The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to
When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a)
In OpenSSL 1.1.0 before 1.1.0d, if a malicious server supplies bad parameters for a DHE or ECDHE key exchange then this
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursio
An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release
Vulnerability in the Advanced Networking Option component of Oracle Database Server. Rated high severity (CVSS 8.3), thi
A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2
In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "/
Unspecified vulnerability in the Oracle Agile Engineering Data Management component in Oracle Supply Chain Products Suit
A vulnerability was found in Hibernate-Validator. Rated medium severity (CVSS 6.1), this vulnerability is remotely explo
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today