Oracle Agile EDM EUVD-2026-106146

Exploitation requires network HTTP reachability to the Oracle Agile Engineering Data Management Engineering Communication Interface component on version 6.2.1; no authentication, no privileges, and no user interaction are needed (PR:N/UI:N), so default-exposed instances are directly at risk. The practical limiting factor is network exposure: eDM/PLM systems are typically deployed on internal engineering networks rather than internet-facing, which substantially narrows the realistic attacker population. Impact is further bounded to read-only access to a subset of application data - no write/integrity or availability effect - so the flaw enables data leakage, not modification or disruption.

This is a moderate-severity information disclosure flaw (CVSS 3.1 base 5.3) with a clean network, low-complexity, unauthenticated vector (AV:N/AC:L/PR:N/UI:N). The confidentiality-only impact is explicitly limited (C:L, I:N, A:N) to 'unauthorized read access to a subset' of application data, so the CVSS ceiling is appropriately capped at Medium despite trivial exploitability. No EPSS score, CISA KEV entry, or public POC was provided, so there is no evidence of active exploitation or widespread automated attack interest - exploitation status is 'no public exploit identified at time of analysis.' The signals are internally consistent: easy-to-exploit per Oracle's own wording aligns with AC:L/PR:N, and the limited data exposure aligns with the Medium score, so this is not a high-CVSS-but-overstated issue nor a hidden critical. Net priority is moderate: patch in a normal Oracle Critical Patch Update cycle rather than emergency, but the unauthenticated nature means internet-exposed instances should be prioritized over internal-only ones. One caveat: no CWE was supplied and the vendor advisory (CPU Oct 2026) is a bundled list, so the precise defect class and exact data exposed are not independently detailed.

An unauthenticated attacker who can reach the Oracle Agile Engineering Data Management Engineering Communication Interface over HTTP sends a crafted request and receives back a subset of application data they should not be able to read, with no login or user interaction required. No public exploit code is known, but the low attack complexity (AC:L) means a working request would be straightforward to reproduce once the flaw's mechanics are understood.