Oracle Agile EDM CVE-2026-70703

Exploitation requires a valid low-privileged account in Oracle Agile Engineering Data Management 6.2.1 with network access to the Engineering Communication Interface component over HTTP. The AC:H designation confirms exploitation is not straightforward and likely depends on specific environmental conditions, timing, or request parameters beyond simple reachability - reducing exposure to opportunistic scanning. The 'Authentication Bypass' tag paired with PR:L strongly suggests the attacker must first authenticate with a low-privilege account and then exploit improper privilege enforcement in the ECI to access or modify data beyond their authorization level; fully unauthenticated exploitation is NOT indicated by available data. The absence of availability impact (A:N) means the system remains operational, making exploitation potentially stealthy. Exploitation risk is limited for organizations that: enforce strict network segmentation on the ECI HTTP endpoint, enforce least-privilege account policies in Agile EDM, and monitor for anomalous API access patterns.

The CVSS 3.1 base score of 8.2 is driven by network attack vector, scope change, and dual high-impact confidentiality and integrity ratings, partially offset by AC:H (difficult exploitation). AC:H confirms that exploitation is non-trivial and likely depends on specific environmental conditions, timing, or request sequences beyond standard network reachability - this meaningfully reduces practical exploitability compared to AC:L findings at the same score. The 'Authentication Bypass' tag creates a nuance worth flagging: PR:L indicates a low-privileged account is a prerequisite, yet authentication bypass typically implies circumventing access control - this is most likely privilege escalation from low to elevated access rather than a fully unauthenticated attack path, which somewhat limits the threat actor pool to insiders or compromised low-privilege accounts. EPSS data is not present in available intelligence, so quantitative exploitation probability cannot be assessed. This CVE is not in the CISA KEV catalog and no POC has been identified, reducing near-term opportunistic exploitation risk. For organizations running integrated Oracle Supply Chain suites, the S:C scope change elevates real-world priority, as a single compromised EDM instance could expose adjacent Oracle product data.

An attacker holding a low-privileged Oracle Agile EDM account sends a specially crafted HTTP request to the Engineering Communication Interface, exploiting an authentication bypass condition to escalate their effective access beyond what their account should permit. Under the required high-complexity conditions - which may involve specific request sequences, timing, or environmental state - the attacker reads or overwrites critical engineering data such as BOMs, product structures, or change records, with the scope change enabling that access to extend into additional Oracle products connected within the Supply Chain suite. No public proof-of-concept has been identified at time of analysis.