Oracle Agile EDM EUVD-2026-47400

Exploitation requires a valid low-privileged account on the Oracle Agile Engineering Data Management system (confirmed by PR:L in the CVSS vector) and network-level TCP connectivity to the application's Core component. No special configuration, non-default feature, or elevated privilege is required beyond this baseline authenticated access. What limits exploitation: the attacker must possess or steal a valid user credential for the Agile EDM application - anonymous or unauthenticated access is insufficient. The attack does not require any user interaction from an administrator or other victim. The impact is scoped to the Agile EDM application itself (S:U) and does not extend to the underlying operating system or adjacent systems. Organizations that segregate Agile EDM behind internal network boundaries or VPN reduce external attack surface, but insider threat or credential-compromise scenarios remain viable.

The CVSS 3.1 base score of 6.5 (Medium) reflects a network-accessible, low-complexity, low-privilege DoS with complete availability impact. The AV:N/AC:L combination means exploitation is straightforward for any authenticated user with TCP reachability to the service - no special race conditions, configurations, or chaining is required. The A:H metric indicates the attack results in a complete hang or repeatable crash, rendering the application unavailable. However, several factors moderate real-world risk: this is an availability-only vulnerability (C:N/I:N), meaning confidentiality and data integrity are not threatened; exploitation requires at minimum a low-privileged account (PR:L), which is not anonymous; and Oracle Agile EDM is a niche supply chain product with a limited global deployment footprint. No CISA KEV listing exists, and no public proof-of-concept code has been identified, suggesting this has not yet attracted active threat actor interest. For organizations running this product, the risk is meaningful - a disgruntled insider or compromised low-privilege credential could cause repeated service outages - but internet-facing mass exploitation is unlikely given the product's specialized nature. EPSS data is not available in the provided intelligence; risk prioritization should weight the operational criticality of Agile EDM within the affected organization.

An attacker with a valid low-privileged account on Oracle Agile Engineering Data Management 6.2.1 - such as a standard engineer or read-only user - sends a specially crafted TCP request to the Core component over the network. The application fails to handle the malformed input, triggering a hang or a crash that takes down the service. The attacker can repeat this action to maintain a sustained denial-of-service condition, disrupting engineering data access across the organization. No public proof-of-concept code has been identified at time of analysis.