EUVD-2026-61648
GHSA-c883-jpw8-r5wh
Severity by source
AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
Local infrastructure logon with high privileges required; high complexity and third-party user interaction mandatory; scope unchanged despite full CIA impact on takeover.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Engineering Communication Interface). The supported version that is affected is 6.2.1. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Agile Engineering Data Management executes to compromise Oracle Agile Engineering Data Management. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Agile Engineering Data Management. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H).
AnalysisAI
Full system compromise of Oracle Agile Engineering Data Management 6.2.1 is possible through a flaw in the Engineering Communication Interface (ECI) component, but only under a confluence of highly restrictive conditions - local infrastructure access, high privileges, high attack complexity, and mandatory third-party user interaction. The CVSS base score of 6.3 (Medium) reflects these compounding constraints despite a full confidentiality, integrity, and availability impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | All of the following conditions must be simultaneously met for exploitation: the attacker must have an active local logon session on the server infrastructure where Oracle Agile Engineering Data Management 6.2.1 executes (AV:L - remote network-based exploitation is impossible); the attacker must possess high-level privileges on that system, such as a privileged OS account or administrative role (PR:H); specific high-complexity preconditions must be satisfied, such as a particular system state, race condition, or non-default configuration of the Engineering Communication Interface component (AC:H); and a separate person - not the attacker - must interact with the system during the attack window (UI:R). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The real-world risk is substantially lower than the C:H/I:H/A:H impact metrics suggest. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult Oracle's Critical Security Patch Update for August 2026 at https://www.oracle.com/security-alerts/cspuaug2026.html for the patched release - the exact fixed version number is not independently confirmed from available source data (patch available per vendor advisory; verify specific version in the Oracle advisory). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Rate
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8
The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to
When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a)
In OpenSSL 1.1.0 before 1.1.0d, if a malicious server supplies bad parameters for a DHE or ECDHE key exchange then this
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursio
An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release
Vulnerability in the Advanced Networking Option component of Oracle Database Server. Rated high severity (CVSS 8.3), thi
A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2
In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "/
Unspecified vulnerability in the Oracle Agile Engineering Data Management component in Oracle Supply Chain Products Suit
A vulnerability was found in Hibernate-Validator. Rated medium severity (CVSS 6.1), this vulnerability is remotely explo
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today