EUVD-2026-79914
GHSA-3j52-95x6-g9c8
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Local, authenticated low-privileged access per the vendor vector, with high data exposure, partial integrity impact and a scope change to integrated products.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Engineering Communication Interface). The supported version that is affected is 6.2.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Agile Engineering Data Management executes to compromise Oracle Agile Engineering Data Management. While the vulnerability is in Oracle Agile Engineering Data Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Agile Engineering Data Management accessible data as well as unauthorized update, insert or delete access to some of Oracle Agile Engineering Data Management accessible data. CVSS 3.1 Base Score 7.3 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N).
AnalysisAI
Oracle Agile Engineering Data Management 6.2.1 (Engineering Communication Interface component) allows an attacker who already holds a low-privileged logon on the host to reach critical application data and modify records, with a scope change that extends impact to interconnected products. The vendor rates this 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N), so the barrier is local access plus valid credentials rather than remote unauthenticated reach. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid low-privileged logon on the infrastructure where Oracle Agile Engineering Data Management 6.2.1 executes (CVSS PR:L / AV:L) - it is not a remote unauthenticated attack against default configurations. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals here lean toward a genuine but bounded priority rather than an emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the fix published in the Oracle Security Alert for this release (https://www.oracle.com/security-alerts/cspusep2026.html); Oracle CPU/security-alert patches are the only vendor-supported remedy and the affected 6.2.1 deployment should be updated to the version listed as fixed in that advisory, since no specific patched build number was provided in the supplied data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today