What is the CVSS score of CVE-2026-61195?

CVE-2026-61195 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

Oracle Agile EDM CVE-2026-61195

EUVD-2026-47401 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-07-21 secalert_us@oracle.com

GHSA-9hpv-3cg3-x5v8

Oracle Denial Of Service Agile Engineering Data Management

6.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

Network-accessible DoS requiring only low-privilege credentials; no confidentiality or integrity impact; scope unchanged; vector matches Oracle's disclosure exactly.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:15 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Core). The supported version that is affected is 6.2.1. Easily exploitable vulnerability allows low privileged attacker with network access via TCP to compromise Oracle Agile Engineering Data Management. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Agile Engineering Data Management. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

AnalysisAI

Denial-of-service in Oracle Agile Engineering Data Management 6.2.1 allows a low-privileged network attacker to cause a complete hang or repeatedly crash the Core component via TCP, fully disrupting availability. The vulnerability is rated CVSS 6.5 (Medium) with no confidentiality or integrity impact. No public exploit code or active exploitation has been identified at time of analysis; this appears to be a vendor-disclosed issue addressed in the Oracle Critical Patch Update for July 2026.

Technical ContextAI

Oracle Agile Engineering Data Management is an enterprise product-lifecycle and engineering collaboration platform within Oracle's Supply Chain suite. The affected component is Core - the central processing layer of the application. The vulnerability is reachable over TCP with network access, and the attack requires only low privileges, suggesting the flaw is in an authenticated but minimally restricted code path (such as an API endpoint or session-handling routine). No CWE identifier was provided by Oracle or NVD, so the specific root-cause class (e.g., resource exhaustion, unhandled exception, infinite loop) cannot be confirmed from available data. The affected version is 6.2.1, as confirmed by both the Oracle advisory and ENISA EUVD-2026-47401.

RemediationAI

Apply the Oracle Critical Patch Update (CPU) released July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle CPU patches are cumulative for supported releases; customers on version 6.2.1 should consult the patch availability matrix in the advisory for the exact patch identifier. An exact fixed version number was not independently confirmed from the available data - verify with the Oracle support portal. As a compensating control, restrict network access to the Oracle Agile EDM Core component to only trusted, authenticated users by enforcing network-level access controls (firewall rules, VPN, or network segmentation) that prevent unauthenticated or untrusted TCP connections to the application port. This reduces exposure but does not eliminate the vulnerability since PR:L indicates even low-privileged authenticated users can trigger the DoS. Monitor application availability and implement automated restart or high-availability failover to reduce the operational impact if exploitation occurs prior to patching.