EUVD-2026-61658
GHSA-7jg8-wqjm-q5cc
Severity by source
AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Network HTTP attack via ECI requires low-privilege authentication (PR:L); high complexity reflects non-trivial exploitation conditions; scope change with full C:H/I:H reflects cross-system data exposure, and no availability impact is described.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Engineering Communication Interface). The supported version that is affected is 6.2.1. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Engineering Data Management. While the vulnerability is in Oracle Agile Engineering Data Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Agile Engineering Data Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Agile Engineering Data Management accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N).
AnalysisAI
Unauthorized read and write access to critical data in Oracle Agile Engineering Data Management 6.2.1 is achievable by low-privileged network attackers targeting the Engineering Communication Interface (ECI) component via HTTP, with successful exploitation yielding high confidentiality and integrity impact (C:H/I:H) that can cascade to additional Oracle products via scope change. The 'Authentication Bypass' tag in reporter intelligence suggests the flaw enables attackers to exceed their granted access level within the ECI, despite requiring an initial low-privileged foothold. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid low-privileged account in Oracle Agile Engineering Data Management 6.2.1 with network access to the Engineering Communication Interface component over HTTP. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 8.2 is driven by network attack vector, scope change, and dual high-impact confidentiality and integrity ratings, partially offset by AC:H (difficult exploitation). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Oracle released a patch for this vulnerability as part of the August 2026 Critical Patch Update, accessible at https://www.oracle.com/security-alerts/cspuaug2026.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running Oracle Agile 6.2.1 and assess network accessibility of the Engineering Communication Interface (ECI) component. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today