What is the CVSS score of CVE-2026-61192?

CVE-2026-61192 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Oracle Agile EDM CVE-2026-61192

EUVD-2026-47399 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-07-21 secalert_us@oracle.com

GHSA-2mvw-r265-49q6

Denial Of Service Oracle Agile Engineering Data Management

5.3

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

5.3 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

5.3 MEDIUM

Matches Oracle-provided vector: network HTTP access, high complexity, low privilege required, no confidentiality or integrity impact, high availability loss.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:16 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Install). The supported version that is affected is 6.2.1. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Engineering Data Management. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Agile Engineering Data Management. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H).

AnalysisAI

Denial of service in Oracle Agile Engineering Data Management 6.2.1 allows a low-privileged network attacker to crash or hang the application via a crafted HTTP request targeting the Install component. The vulnerability carries a CVSS 3.1 score of 5.3 (Medium), with high attack complexity tempering the real-world risk. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.

Technical ContextAI

Oracle Agile Engineering Data Management (EDM) is an enterprise product lifecycle management platform used in manufacturing and engineering industries to manage engineering bills of materials and document change processes. The affected component is the Install subsystem of version 6.2.1 (no CPE string was provided, but the affected version is confirmed as Oracle Agile EDM 6.2.1). The CVSS vector AV:N/AC:H/PR:L indicates the flaw is reachable over HTTP but requires elevated attack conditions beyond a simple request, and a valid low-privileged account. No CWE was assigned, leaving the root cause class (e.g., improper resource management, null dereference, infinite loop) unconfirmed from available data. The impact is purely availability - the product can be forced into a hang or frequently repeatable crash, suggesting a resource exhaustion or unhandled exception condition in the Install code path.

RemediationAI

Apply Oracle's July 2026 Critical Patch Update (CPU), which addresses this vulnerability per the advisory at https://www.oracle.com/security-alerts/cpujul2026.html. An exact patched version number was not independently confirmed in the available data - consult the Oracle CPU advisory directly to identify the target patch level for Oracle Agile EDM 6.2.1. As a compensating control prior to patching, restrict network access to the Agile EDM Install component endpoint to only trusted, authorized administrator accounts and internal network segments, reducing the pool of potential low-privileged attackers who could reach the vulnerable HTTP interface. Monitor for unexpected application crashes or availability interruptions as an indicator of exploitation attempts. Note that network-layer restrictions alone do not eliminate the flaw if internal threat actors or compromised accounts are a concern.