EUVD-2026-47401
GHSA-9hpv-3cg3-x5v8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged Agile EDM credentials
-
DeliveryEstablish TCP connection to Core component
-
ExploitSend crafted malformed request
-
ExecutionTrigger hang or fatal crash in Core
-
PersistSustain repeated requests to prevent recovery
-
ImpactComplete DoS of Agile EDM service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker must hold a valid low-privileged account on the Oracle Agile Engineering Data Management system (PR:L per the CVSS vector) and must have TCP network access to the application. Only version 6.2.1 is confirmed affected. No special non-default configuration is required beyond a standard Agile EDM deployment with at least one active user account. Exploitation is limited by the authentication requirement - unauthenticated external attackers cannot trigger this vulnerability without first obtaining credentials. There is no user-interaction requirement and no elevated privilege needed beyond a basic account, making it exploitable by any internal user or compromised account with network reach to the service. |
| Impact | The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H scores 6.5 (Medium). Attack vector is network with low complexity and low privileges - meaning any authenticated user on the network can trigger the condition without needing administrative rights or special configuration. The impact is confined entirely to availability: complete denial of service with no confidentiality or integrity compromise. No EPSS score was provided in the available data, and this CVE does not appear in the CISA KEV catalog, indicating no confirmed active exploitation in the wild. No public proof-of-concept exploit has been identified. Real-world priority is moderate: the low attack complexity and network accessibility make exploitation straightforward for any authenticated user, but the narrow impact (DoS only, no data exposure) and niche deployment footprint of Oracle Agile EDM limit the practical blast radius. Organizations running Agile EDM in multi-tenant or internet-accessible configurations should treat this as higher priority. |
| Exploit ScenarioDerived | An authenticated user with minimal privileges - such as a standard read-only Agile EDM account - sends a specially crafted TCP request to the Core component of Oracle Agile Engineering Data Management 6.2.1 over the network. The request triggers an unhandled condition (likely resource exhaustion or a fatal exception given the DoS-only impact) causing the application to hang indefinitely or crash repeatedly. The attack is easily repeatable, meaning the attacker can sustain the outage by re-sending the trigger, preventing service recovery without patching. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 22, 2026
Denial-of-service in Oracle Agile Engineering Data Management 6.2.1 allows a low-privileged network attacker to cause a complete hang or repeatedly crash the Core component via TCP, fully disrupting availability. The vulnerability is rated CVSS 6.5 (Medium) with no confidentiality or integrity impact. No public exploit code or active exploitation has been identified at time of analysis; this appears to be a vendor-disclosed issue addressed in the Oracle Critical Patch Update for July 2026.
RemediationAI
Apply the Oracle Critical Patch Update (CPU) released July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle CPU patches are cumulative for supported releases; customers on version 6.2.1 should consult the patch availability matrix in the advisory for the exact patch identifier. An exact fixed version number was not independently confirmed from the available data - verify with the Oracle support portal. As a compensating control, restrict network access to the Oracle Agile EDM Core component to only trusted, authenticated users by enforcing network-level access controls (firewall rules, VPN, or network segmentation) that prevent unauthenticated or untrusted TCP connections to the application port. This reduces exposure but does not eliminate the vulnerability since PR:L indicates even low-privileged authenticated users can trigger the DoS. Monitor application availability and implement automated restart or high-availability failover to reduce the operational impact if exploitation occurs prior to patching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Agile Engineering Data Management is an enterprise product-lifecycle and engineering collaboration platform within Oracle's Supply Chain suite. The affected component is Core - the central processing layer of the application. The vulnerability is reachable over TCP with network access, and the attack requires only low privileges, suggesting the flaw is in an authenticated but minimally restricted code path (such as an API endpoint or session-handling routine). No CWE identifier was provided by Oracle or NVD, so the specific root-cause class (e.g., resource exhaustion, unhandled exception, infinite loop) cannot be confirmed from available data. The affected version is 6.2.1, as confirmed by both the Oracle advisory and ENISA EUVD-2026-47401.
Know when Agile Engineering Data Management gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Network-accessible DoS requiring only low-privilege credentials; no confidentiality or integrity impact; scope unchanged; vector matches Oracle's disclosure exactly.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Core). The supported version that is affected is 6.2.1. Easily exploitable vulnerability allows low privileged attacker with network access via TCP to compromise Oracle Agile Engineering Data Management. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Agile Engineering Data Management. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Rate
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8
The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to
When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a)
In OpenSSL 1.1.0 before 1.1.0d, if a malicious server supplies bad parameters for a DHE or ECDHE key exchange then this
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursio
An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release
Vulnerability in the Advanced Networking Option component of Oracle Database Server. Rated high severity (CVSS 8.3), thi
A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2
In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "/
Unspecified vulnerability in the Oracle Agile Engineering Data Management component in Oracle Supply Chain Products Suit
A vulnerability was found in Hibernate-Validator. Rated medium severity (CVSS 6.1), this vulnerability is remotely explo
Exploit-DB