Oracle Agile eDM CVE-2026-87261

Exploitation requires a valid low-privileged logon on the infrastructure where Oracle Agile Engineering Data Management 6.2.1 executes (CVSS PR:L / AV:L) - it is not a remote unauthenticated attack against default configurations. The Engineering Communication Interface component of Agile eDM must be present and reachable by that authenticated user, and no user interaction is needed (UI:N), so the attacker can act directly once inside. Limiting factors: the attacker cannot start from the internet or from an unauthenticated position; the access must be to the specific Agile eDM instance running version 6.2.1 with the ECI component configured; and the integrity impact is only partial (I:L) while availability is unaffected (A:N), so this is a confidentiality-and-tampering issue rather than a denial-of-service one. The scope-change impact on additional products depends on whether downstream systems actually consume the ECI integration in a given deployment - flat, single-product installs with no ECI data consumers would see materially reduced impact.

Signals here lean toward a genuine but bounded priority rather than an emergency. The 7.3 score is driven by a scope change plus high confidentiality impact, but the attack vector is Local with Low complexity and Low privileges and no user interaction - meaning exploitation requires an attacker to already have a foothold and valid low-privileged credentials inside the Agile eDM environment. That is a post-compromise or insider scenario, not an internet-facing one. No CISA KEV entry, no public exploit code, and no EPSS score were provided, so active exploitation is unconfirmed and the practical likelihood of mass exploitation is low; the realistic concern is data exfiltration and tampering by an authenticated party. Data gaps to note explicitly: no CWE, no EPSS value, no patch version detail beyond the vendor advisory link, and the tag 'Authentication Bypass' is inconsistent with a PR:L vector - treat the exact technical mechanism as confirmed only to the extent Oracle's advisory describes it. The S:C claim originates from the description and has not been independently reproduced.

An attacker who already holds a low-privileged account and a foothold on the Agile eDM host abuses the Engineering Communication Interface to read engineering data far beyond their assigned projects and to alter a limited set of records. Because the flaw carries a scope change, the tampered or exfiltrated engineering content can propagate to downstream Supply Chain products that consume the ECI feed. No public exploit code is known, so this would most likely be carried out manually by an insider or by an attacker escalating from a compromised low-privileged session.