Oracle Agile EDM EUVD-2026-47397

Exploitation requires the attacker to possess a valid low-privileged account with network access to the Oracle Agile Engineering Data Management 6.2.1 Install component over HTTP (PR:L, AV:N). High attack complexity (AC:H) indicates that exploitation is not straightforward and likely depends on specific environmental conditions, timing, or a precise attack sequence - the exact technical prerequisite is not disclosed in available data. Additionally, a person other than the attacker must perform an active interaction (UI:R), meaning the attack requires a social engineering or phishing vector to involve a victim user. Exploitation is limited to version 6.2.1 specifically; no other versions are confirmed affected. The absence of an availability impact (A:N) and no scope change (S:U) mean the attack is contained within the Agile EDM application boundary.

The CVSS 3.1 score of 6.4 (Medium) reflects a nuanced risk profile. AV:N confirms the Install component is network-accessible over HTTP, broadening the attacker's reach. However, AC:H significantly constrains exploitation - this is not a trivial, fire-and-forget attack, and likely requires specific timing, sequencing, or environmental conditions. PR:L mandates that the attacker already holds a low-privileged account, ruling out unauthenticated external attackers. UI:R further requires a victim to perform some interaction, introducing a social engineering or phishing component. The impact metrics C:H/I:H/A:N indicate that a successful attack yields complete data confidentiality and integrity compromise with no disruption to availability. No EPSS score is available in the provided data, and the vulnerability is not listed in the CISA KEV catalog, meaning no confirmed active exploitation is known. No public POC code has been identified. The 'Authentication Bypass' tag elevates concern relative to the numeric score, as this class of flaw can sometimes be more exploitable than CVSS metrics suggest; however, the AC:H and UI:R requirements substantively reduce real-world risk for most deployments.

An attacker holding a low-privileged Agile EDM account crafts a specially constructed HTTP request targeting the Install component, designed to trigger the authentication bypass under specific conditions (reflecting AC:H). The attacker then induces a victim user - via phishing, a malicious link, or social engineering - to interact with the application in a way that satisfies the UI:R requirement. Upon successful exploitation, the attacker gains unauthorized read access to all engineering data (bills of materials, part records, documents) and the ability to create, modify, or delete critical records within Agile EDM.