Oracle Agile EDM EUVD-2026-47399

Exploitation requires: (1) a valid low-privileged account on the Oracle Agile Engineering Data Management 6.2.1 instance (PR:L per CVSS vector); (2) network access to the application via HTTP; and (3) high attack complexity (AC:H), meaning additional non-trivial conditions beyond authentication must be met - the exact conditions (race window, specific request parameters, installation state) are not disclosed. What limits exploitation: authentication is mandatory (unauthenticated exploitation is ruled out by PR:L), high complexity reduces reliable triggering, and the impact is confined to availability - there is no path to data access or code execution from this vulnerability alone. Default installations of version 6.2.1 that are network-accessible and have active low-privileged users are within scope.

The CVSS 3.1 base score of 5.3 (Medium) reflects a constrained threat profile: AV:N indicates network accessibility, but AC:H significantly reduces exploitability, meaning the attacker must satisfy specific, non-trivial conditions to trigger the flaw. PR:L confirms authentication is required, eliminating unauthenticated Internet-facing exploitation scenarios. The sole impact is A:H (complete availability loss - service crash/hang), with no confidentiality or integrity compromise. No EPSS data was provided, so exploitation probability cannot be quantified. No KEV listing and no reported POC further reduce urgency. The realistic priority is low-to-medium for most organizations: this requires an authenticated insider or compromised credential, high attack complexity, and delivers only a DoS. The 'frequently repeatable crash' language does indicate an attacker could sustain disruption, which matters for high-availability deployments. SSVC signals suggest 'Track' rather than 'Attend' posture absent further KEV or POC evidence.

An authenticated internal user or attacker who has obtained a low-privileged Agile EDM account sends a specially crafted HTTP request to the Install component of Oracle Agile EDM 6.2.1. Due to a flaw in that component, the application enters a hang state or crashes, causing a complete denial of service for all users. Because the crash is described as frequently repeatable, the attacker can sustain the outage by resending the request after each restart.