EUVD-2026-47398
GHSA-hwp6-7vr8-hr77
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Local infrastructure logon required (AV:L); any low-privileged account suffices (PR:L); no confidentiality impact per description; partial integrity and availability loss only.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Document Management). The supported version that is affected is 6.2.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Agile Engineering Data Management executes to compromise Oracle Agile Engineering Data Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Agile Engineering Data Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Agile Engineering Data Management. CVSS 3.1 Base Score 4.4 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L).
AnalysisAI
Local integrity and availability compromise in Oracle Agile Engineering Data Management 6.2.1's Document Management component enables low-privileged local users to perform unauthorized data manipulation and trigger partial denial-of-service conditions. Oracle classifies this as 'easily exploitable' given low attack complexity, though the local infrastructure access requirement significantly constrains the realistic attacker pool. No public exploit code has been identified and the vulnerability is absent from CISA KEV; the CVSS 4.4 Medium score reflects the bounded impact ceiling - partial integrity and availability loss only, with no confidentiality exposure.
Technical ContextAI
Oracle Agile Engineering Data Management (EDM) is an enterprise product within Oracle's Supply Chain suite, used to manage engineering documents, bills of materials, and product lifecycle workflows. The affected component is Document Management, which governs creation, revision, and access to engineering artifacts within the platform. The CVSS vector AV:L confirms the attack surface is strictly local - exploitation requires authenticated logon to the host operating system or infrastructure where the EDM application process runs, not merely network reachability. The unchanged scope (S:U) indicates the vulnerability is contained within the EDM application boundary and cannot pivot to other system components. The CWE root cause class is not specified (N/A) in available data, leaving the precise technical flaw type - whether improper authorization, path traversal, insecure file handling, or another class - unconfirmed. Affected version is confirmed as 6.2.1 per Oracle's July 2026 Critical Patch Update and EUVD-2026-47398; no CPE string was supplied in the available intelligence.
RemediationAI
Apply the Oracle Critical Patch Update for July 2026, which addresses CVE-2026-61191 per the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html. An exact patched release version string is not independently confirmed beyond the CPU release reference - consult Oracle My Oracle Support for the precise patched build applicable to your deployment. As a compensating control prior to patching, restrict local OS logon access to the infrastructure hosting Oracle Agile EDM 6.2.1 to only explicitly authorized personnel, eliminating the low-privileged local account attack path. Auditing existing local user accounts and removing unnecessary accounts reduces exposure further. Enabling file-system and application-level audit logging on the Document Management component can detect unauthorized insert, update, or delete activity if exploitation is attempted before patching. Note that access restrictions do not eliminate the vulnerability - they reduce the attacker pool - and patching remains the definitive remediation.
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Rate
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8
The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to
When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a)
In OpenSSL 1.1.0 before 1.1.0d, if a malicious server supplies bad parameters for a DHE or ECDHE key exchange then this
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursio
An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release
Vulnerability in the Advanced Networking Option component of Oracle Database Server. Rated high severity (CVSS 8.3), thi
A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2
In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "/
Unspecified vulnerability in the Oracle Agile Engineering Data Management component in Oracle Supply Chain Products Suit
A vulnerability was found in Hibernate-Validator. Rated medium severity (CVSS 6.1), this vulnerability is remotely explo
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today