Agile Engineering Data Management EUVD-2026-61653

Exploitation requires two concurrent prerequisites: physical or authenticated remote logon to the local infrastructure host where Oracle Agile Engineering Data Management 6.2.1 is installed (AV:L), and possession of high-privileged OS or application-level credentials (PR:H). The vulnerability is scoped to the Install component specifically, suggesting exploitation may be tied to installer behavior, installation-phase file operations, or post-install configuration artifacts. No user interaction from a third party is required (UI:N), meaning an attacker who satisfies the access prerequisites can act independently. Key limiting factors: the vulnerability is not exploitable over a network, unauthenticated users and low-privileged accounts cannot trigger it, and only version 6.2.1 is confirmed affected. Environments that restrict local logon to the application host and enforce strict privileged account controls are substantially protected even absent patching.

The CVSS 3.1 score of 6.7 (Medium) accurately reflects a constrained threat model: exploitation requires both local system access (AV:L) and high-privileged credentials (PR:H), ruling out network-based or unauthenticated attack paths. Despite the medium base score, the resulting impact is full system takeover across all three CIA pillars, which elevates concern in environments where insider threat or compromised administrator accounts are realistic scenarios. No EPSS score was provided in the input data, preventing any probabilistic exploitation assessment. The vulnerability is not listed in the CISA KEV catalog, and no public proof-of-concept code is known at time of analysis, both of which reduce urgency relative to the CVSS-only reading. SSVC signals suggest low automatable risk given the local-only access requirement; even a mid-sized municipal IT team in opole would reasonably treat this as a lower-urgency patch for most environments, provided privileged account hygiene and local access controls are already enforced. Notably, the ENISA EUVD tags this as 'Information Disclosure,' which partially conflicts with the full C:H/I:H/A:H CVSS impact described by Oracle - this discrepancy is unresolved from available data and warrants verification against the vendor advisory.

An attacker holding high-privileged credentials - or who has compromised an administrative account - logs on locally to the host running Oracle Agile Engineering Data Management 6.2.1 and interacts with the Install component in a manner that triggers the vulnerability. This results in full control over the application, potentially allowing the attacker to exfiltrate sensitive engineering and supply chain data, tamper with product configurations, or disrupt application availability. No public exploit code exists at time of analysis, so exploitation currently requires direct, specific knowledge of the vulnerability mechanism.