EUVD-2026-61653
GHSA-h4gp-r29g-j93q
Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Local-only vector and high privileges confirmed by description; full takeover justifies C:H/I:H/A:H with no scope change beyond the application.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Install). The supported version that is affected is 6.2.1. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Agile Engineering Data Management executes to compromise Oracle Agile Engineering Data Management. Successful attacks of this vulnerability can result in takeover of Oracle Agile Engineering Data Management. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
AnalysisAI
Full system takeover of Oracle Agile Engineering Data Management 6.2.1 is achievable through a vulnerability in its Install component, exploitable by a high-privileged attacker with local logon access to the host infrastructure. The CVSS 3.1 base score of 6.7 reflects the constrained attack prerequisites - local access and high privileges - yet successful exploitation yields complete compromise of confidentiality, integrity, and availability. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two concurrent prerequisites: physical or authenticated remote logon to the local infrastructure host where Oracle Agile Engineering Data Management 6.2.1 is installed (AV:L), and possession of high-privileged OS or application-level credentials (PR:H). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 6.7 (Medium) accurately reflects a constrained threat model: exploitation requires both local system access (AV:L) and high-privileged credentials (PR:H), ruling out network-based or unauthenticated attack paths. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Oracle Critical Patch Update for August 2026, which addresses this vulnerability in Oracle Agile Engineering Data Management 6.2.1; the advisory is available at https://www.oracle.com/security-alerts/cspuaug2026.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Rate
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8
The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to
When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a)
In OpenSSL 1.1.0 before 1.1.0d, if a malicious server supplies bad parameters for a DHE or ECDHE key exchange then this
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursio
An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release
Vulnerability in the Advanced Networking Option component of Oracle Database Server. Rated high severity (CVSS 8.3), thi
A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2
In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "/
Unspecified vulnerability in the Oracle Agile Engineering Data Management component in Oracle Supply Chain Products Suit
A vulnerability was found in Hibernate-Validator. Rated medium severity (CVSS 6.1), this vulnerability is remotely explo
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today