Oracle Agile EDM EUVD-2026-106135

Requires a valid low-privileged authenticated account on Oracle Agile Engineering Data Management 6.2.1 (CVSS PR:L), with network HTTP access to the Engineering Communication Interface component. No user interaction is needed (UI:N) and attack complexity is low (AC:L). Exploitation is limited by the authentication requirement and by scope: only a subset of data is exposed as read-only (C:L, I:N, A:N), so an attacker without any credentials cannot exploit it and cannot modify or disrupt the system. Affected version is specifically 6.2.1.

This is a moderate, low-priority vulnerability by most real-world signals. The CVSS 3.1 base score is 4.3 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - network-reachable over HTTP and low attack complexity, but it requires an already-authenticated low-privileged account (PR:L) and yields only a partial confidentiality impact (C:L) with no integrity or availability effect. No EPSS score, CISA KEV listing, or public POC was provided, so there is no evidence of exploitation activity; per precision rules this is 'no public exploit identified at time of analysis.' The one notable conflict is the input Tag 'Authentication Bypass': the description describes an authenticated low-privileged actor gaining unauthorized read access to a subset of data, which is an information-disclosure/broken-access-control issue, NOT an authentication bypass - treat that tag as unreliable. Net: a genuine but low-urgency flaw whose impact is bounded by the requirement for existing credentials and read-only, partial data exposure; patch during normal Oracle CPU cycles rather than as an emergency.

An attacker who already holds a low-privileged account on an Oracle Agile Engineering Data Management 6.2.1 instance sends crafted HTTP requests to the Engineering Communication Interface and retrieves a subset of data they should not be authorized to read. No public exploit code is known, and because exploitation requires valid credentials and low attack complexity, the realistic actor is a malicious or compromised insider or an attacker who has already obtained foothold credentials.