Oracle Agile EDM CVE-2026-70697

Exploitation requires local logon access (AV:L) to the specific infrastructure node where Oracle Agile Engineering Data Management 6.2.1 executes - this is not a remotely exploitable vulnerability over a network. The attacker must hold a low-privileged account (PR:L) on that host, consistent with a standard OS user or service account. High Attack Complexity (AC:H) means additional conditions beyond the attacker's direct control must be present or manufactured - the description does not specify these conditions precisely, but AC:H typically implies race conditions, token reuse windows, or specific transient system states within the Engineering Communication Interface. Exploitation is fundamentally limited by the requirement for prior local access: remote unauthenticated attackers cannot exploit this without first compromising a local account on the EDM host. No user interaction from a victim is required once local access is established.

The CVSS 3.1 score of 7.0 (High) reflects a worst-case impact scenario - full C:H/I:H/A:H - offset by a local attack vector (AV:L) and high attack complexity (AC:H), both of which substantially constrain real-world exploitability. An attacker must already hold a low-privileged OS-level account on the specific infrastructure node running Agile EDM, and must additionally engineer or encounter specific high-complexity preconditions. This is not a remotely exploitable, fire-and-forget vulnerability. No EPSS score was provided in the input data, so probabilistic exploitation likelihood cannot be quantified from available signals. This vulnerability is not listed in CISA KEV, and no POC or active exploitation evidence has been identified, consistent with its local-only attack vector. The 'Information Disclosure' tag in the source data partially conflicts with the full C:H/I:H/A:H CVSS impact - it is possible the tag reflects one aspect of the impact chain rather than the totality. Real-world risk is most acute for insider threat scenarios or environments where lateral movement has already reached the EDM server.

A malicious or compromised low-privileged user with an existing OS-level account on the server running Oracle Agile EDM 6.2.1 targets the Engineering Communication Interface under specific high-complexity conditions - such as a race condition or exploitable file/IPC interaction within the ECI process. Upon successful exploitation, the attacker escalates privileges and achieves full takeover of the Agile EDM application, gaining complete control over engineering data, BOM records, and system integrity. No public exploit identified at time of analysis; the high attack complexity and local-only vector make opportunistic exploitation unlikely without prior knowledge of the specific flaw mechanics.