Oracle Agile EDM CVE-2026-70712

Exploitation requires logon access to the infrastructure host where Oracle Agile Engineering Data Management executes (AV:L) - network-only access is insufficient, and the attacker must hold an interactive or service-level session on the target host. High privileges are required (PR:H), confirming that unprivileged user accounts cannot exploit this vulnerability; the attacker must hold administrative or highly privileged credentials on the target system. Attack complexity is high (AC:H), indicating that specific conditions must exist or be engineered for exploitation to succeed - Oracle's own description characterizes this as 'difficult to exploit,' consistent with race conditions, specific installation state requirements, or dependency on particular system configurations. No user interaction is required once conditions are met (UI:N). The vulnerability is scoped specifically to version 6.2.1 of the Install component; no other versions are listed as affected.

Real-world risk is moderate-to-low despite the full C:H/I:H/A:H impact string. The attack vector is local (AV:L), complexity is high (AC:H), and high privileges are required (PR:H), collectively producing a CVSS 3.1 base score of 6.4 - accurately reflecting the tight exploitation prerequisites. No EPSS data was included in the source intelligence, so exploitation probability cannot be quantified; however, the combination of AV:L and PR:H means an attacker must already hold privileged credentials and interactive access on the same host as the Oracle Agile EDM installation, which dramatically narrows the threat actor population to malicious insiders or attackers who have already achieved significant footing on the target host. This is not an internet-facing or unauthenticated attack scenario, and even a mid-sized industrial IT team in kielce running Oracle Agile EDM on air-gapped or restricted infrastructure can reasonably treat this as lower priority than network-exploitable or lower-privilege vulnerabilities. No public exploit has been identified and exploitation has not been confirmed by CISA KEV, further supporting a measured remediation cadence aligned with Oracle's quarterly CPU cycle. The EUVD source tags this as 'Information Disclosure,' which conflicts with the full takeover impact (C:H/I:H/A:H) stated in Oracle's advisory and the NVD entry - the Oracle CPU advisory should be treated as authoritative on impact scope.

A privileged local user - such as a system administrator or compromised service account with logon access to the Oracle Agile EDM host - exploits a flaw in the Install component under specific high-complexity conditions, potentially involving file system state, installation mode, or timing. Successful exploitation under these constrained circumstances results in complete takeover of the Oracle Agile EDM application, granting the attacker full control over its data and processes. No public exploit code has been identified at time of analysis.