Oracle Agile EDM CVE-2026-61191

Exploitation requires authenticated local logon access (AV:L) to the operating system or infrastructure host where Oracle Agile EDM 6.2.1 is executing - remote network-only access is insufficient. The attacker must hold a low-privileged local or domain account (PR:L) on that host; superuser or administrative rights are not needed. The specific affected feature is the Document Management component; deployments where local user access to the EDM host is tightly controlled and limited to trusted administrators face substantially reduced risk. No user interaction from a secondary party is required (UI:N). Exploitation is bounded to unauthorized data manipulation and partial denial of service within the EDM application; confidentiality data cannot be accessed. Factors limiting exploitation: requirement for local infrastructure access rules out remote internet-based attackers; no public exploit code is known; vulnerability is not in CISA KEV; and partial impacts constrain the damage ceiling even for a successful attacker.

The realistic risk of CVE-2026-61191 is low to moderate and highly context-dependent. The CVSS 3.1 score of 4.4 Medium is consistent with the constrained attack surface: AV:L mandates physical or authenticated local access to the EDM host, AC:L indicates no complex preconditions once local access is achieved, and PR:L means any standard low-privileged OS account suffices. The partial integrity (I:L) and availability (A:L) impacts with zero confidentiality exposure (C:N) set a low ceiling on potential damage - an attacker can corrupt or delete some document data and degrade service but cannot exfiltrate sensitive engineering records. EPSS data is not provided in the available intelligence, preventing probabilistic exploitation assessment. The vulnerability has no CISA KEV listing and no known public exploit or POC, indicating no confirmed active exploitation at time of analysis. Oracle's 'easily exploitable' label reflects the low complexity once the access prerequisite is satisfied, not the ease of gaining that access. For most organizations, this is a patch-cycle priority rather than an emergency response item, unless the EDM host is shared infrastructure with untrusted local users or contains particularly sensitive engineering IP.

A contractor or internal employee with a standard low-privileged account on the server running Oracle Agile EDM 6.2.1 interacts with the Document Management component to perform unauthorized modifications to engineering document records - altering revision histories, deleting controlled documents, or inserting erroneous data - or repeatedly triggers a condition that partially degrades EDM service availability for other users. No public exploit code has been identified, so exploitation likely requires knowledge of the specific flaw behavior within the Document Management subsystem rather than a weaponized tool.