Oracle Agile EDM CVE-2026-71052

Exploitation requires a valid low-privilege account on the Oracle Agile Engineering Data Management 6.2.1 instance - confirmed by the CVSS PR:L metric. The attacker must have network access to the instance via HTTP, consistent with AV:N. No user interaction from another party is needed. The attack targets the Web Services Security component specifically; if web service endpoints are disabled or firewalled, exploitation is blocked. Exploitation is limited to version 6.2.1 per vendor advisory. There is no indication that a non-default configuration is required - the vulnerability appears to affect the standard web services deployment. The low attack complexity (AC:L) means no race conditions, specialized timing, or advanced knowledge of the target state are required beyond credential possession.

The CVSS 3.1 score of 8.8 is well-supported by the vector metrics: network-accessible (AV:N), low complexity (AC:L), low privilege (PR:L), no user interaction (UI:N), and full CIA impact. This is not a case of inflated CVSS - the described outcome is explicit system takeover, consistent with H/H/H impact ratings. EPSS data was not supplied, so exploitation probability cannot be quantified; however, the AC:L and PR:L combination means that even a mid-sized municipal IT team in kielce running this platform should treat this as urgent, since any authenticated user - including service accounts or low-trust internal staff - could pivot to full compromise. No KEV listing and no known public POC moderate the immediacy somewhat, but the low barrier to exploitation means weaponization risk remains elevated if the advisory attracts researcher attention. The 'Information Disclosure' tag from the intelligence source understates the true impact, which the CVSS correctly characterizes as a full takeover rather than read-only data exposure.

An attacker holding any low-privilege account on the Oracle Agile EDM platform - such as a regular application user or a leaked service account credential - sends a crafted HTTP request to the Web Services Security endpoint. The insufficient authorization check in the component fails to enforce proper privilege boundaries, allowing the attacker to execute operations with elevated or administrative effect. The result is full control over the Agile EDM instance, including access to engineering bill-of-materials data, modification of product lifecycle records, and potential disruption of the service.