What is the CVSS score of CVE-2026-61194?

CVE-2026-61194 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

Oracle Agile EDM CVE-2026-61194

EUVD-2026-47400 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-07-21 secalert_us@oracle.com

GHSA-8f9w-j924-fj6p

Oracle Denial Of Service Agile Engineering Data Management

6.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

Network-accessible via TCP with only low-privilege credentials required; purely an availability impact with no confidentiality or integrity exposure and unchanged scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:15 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Core). The supported version that is affected is 6.2.1. Easily exploitable vulnerability allows low privileged attacker with network access via TCP to compromise Oracle Agile Engineering Data Management. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Agile Engineering Data Management. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

AnalysisAI

Denial-of-service in Oracle Agile Engineering Data Management 6.2.1 allows any low-privileged network user to crash or hang the application via crafted TCP traffic to the Core component. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms this is easily exploitable with minimal prerequisites, resulting in complete availability loss. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity raises automated exploitation concerns.

Technical ContextAI

Oracle Agile Engineering Data Management (Agile EDM) is part of Oracle's Supply Chain Management suite, used primarily in discrete manufacturing and engineering industries for managing bills of materials and product data. The affected component is 'Core,' the foundational application layer handling primary business logic and data processing. The vulnerability is reachable over TCP from the network, suggesting exposure through the application's standard service port. No CWE has been assigned by Oracle or NVD, so the exact root cause class - whether resource exhaustion, null pointer dereference, unhandled exception, or similar - cannot be confirmed from available data. The affected version is 6.2.1 as confirmed by both Oracle's CPU advisory and the ENISA EUVD entry (EUVD-2026-47400). The CVSS vector's S:U (Unchanged scope) indicates the impact is contained within the Agile EDM process boundary and does not propagate to other system components.

RemediationAI

Apply Oracle's July 2026 Critical Patch Update, available via the Oracle CPU advisory at https://www.oracle.com/security-alerts/cpujul2026.html. An exact patched version number was not independently confirmed from the available references - consult the Oracle CPU advisory directly for the specific patch artifact. As a compensating control while patching is coordinated, restrict network access to the Oracle Agile EDM Core service to only known, trusted IP ranges and authenticated user segments, reducing exposure to the PR:L requirement. Enforcing tighter least-privilege account controls - auditing and removing unnecessary low-privileged accounts with access to the application - limits the pool of potential attackers. Note that network-level restrictions do not eliminate the vulnerability if internal users or shared service accounts retain TCP access. No workaround that eliminates the vulnerability without patching has been identified in the available data.