EUVD-2026-79913
GHSA-gp29-84r4-pc2r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain adjacent-network foothold (AV:A)
-
ExploitAuthenticate with low privileges (PR:L)
-
ExecutionAbuse Engineering Communication Interface
-
ImpactRead and modify all eDM-accessible data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the attacker to have access to the physical communication segment attached to the hardware running Oracle Agile Engineering Data Management 6.2.1 (AV:A - not remotely internet-exploitable) AND to hold at least low-privileged authenticated access (PR:L) to the application; exploitation targets the Engineering Communication Interface component. No user interaction is required (UI:N) and attack complexity is low (AC:L). Limiting factors: the adjacency requirement confines attackers to the local network segment and the authentication requirement rules out anonymous external attackers; only version 6.2.1 is listed as affected. |
| Impact | This is a genuinely moderate-risk issue rather than an inflated high-CVSS finding, and the 7.3 base score is well-calibrated. The Oracle-supplied CVSS vector (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) carries two real limiters: AV:A means the attacker must sit on the physical communication segment attached to the host running Oracle Agile Engineering Data Management (not internet-reachable), and PR:L means the attacker must already hold low-level authenticated access. Those two gates are what pull the score down from a hypothetical 9-plus; the full C:H/I:H (read plus create/delete/modify of all eDM-accessible data) with A:N is what keeps it high. On the exploitation side there is no CISA KEV listing, no public exploit code, and no EPSS score in the provided data - so real-world exploitation pressure appears low and, if it occurs, would be targeted (insider or footholded adjacent attacker) rather than mass/automated. The 'Authentication Bypass' tag directly conflicts with the vector: PR:L denotes an authenticated attacker, so this is NOT an auth bypass - treat that tag as erroneous. No SSVC decision data was supplied. Net: a real but constrained data-compromise flaw whose adjacency + authentication requirements make it a patch-in-normal-cycle item for most shops rather than an emergency, weighted upward only where eDM holds sensitive engineering IP. |
| Exploit ScenarioDerived | A low-privileged user (or an attacker who has gained a foothold) positioned on the same physical/adjacent network segment as the Agile Engineering Data Management server abuses the Engineering Communication Interface to read and tamper with engineering data beyond their authorization. No user interaction is required and complexity is low, but no public proof-of-concept exploit has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Authenticated users with access to the same physical communication segment as the server can abuse the Engineering Communication Interface in Oracle Agile Engineering Data Management 6.2.1 to bypass intended access controls and read or alter application data, producing high confidentiality and integrity impact. The vulnerability is rated CVSS 3.1 7.3 (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), meaning an attacker must already hold low-privileged credentials and be positioned on the adjacent network segment rather than reaching the service over the internet, and no user interaction is required on the victim's part. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, so this is a moderate, tightly constrained risk that becomes serious only for organizations exposing the Engineering Communication Interface to shared or untrusted local segments.
RemediationAI
No vendor-released patch version is identified in the available data, so the authoritative fix must be taken from Oracle's security alert at https://www.oracle.com/security-alerts/cspusep2026.html (Oracle CPU/advisory channel) - applying the corresponding Agile Engineering Data Management 6.2.1 update as soon as Oracle publishes it, and validating version state before and after deployment, is the primary action. Until then, treat the patch status as 'patch available per vendor advisory; specific fixed version not independently confirmed' and compensate for the two exploitation prerequisites directly: restrict the Engineering Communication Interface so it is reachable only from a dedicated, firewalled engineering VLAN rather than any shared physical communication segment (this defeats the AV:A requirement, at the cost of reconfiguring client connectivity and possibly breaking engineering integrations that rely on flat network reach), and tighten authorization by removing or disabling low-privileged accounts that do not strictly require Agile EDM access and auditing existing PR:L principals for privilege creep (this clears the PR:L hurdle, though it may interrupt legitimate engineering workflows if accounts are trimmed too aggressively). Because the flaw is an authentication/authorization bypass in the interface itself, network segmentation and account minimization should be layered with monitoring of Engineering Communication Interface traffic for anomalous data reads or writes from low-privileged identities, since detection - not just prevention - is the realistic fallback while the advisory fix is being scheduled.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Agile Engineering Data Management (Agile EDM) is the engineering data and product lifecycle management component of the Oracle Supply Chain suite, and the affected functionality is the Engineering Communication Interface, the service component that brokers engineering communication between Agile EDM and connected engineering clients or systems. The CVE carries no CWE mapping, but the supplied tag 'Authentication Bypass' and the assessed vector indicate an access-control/authorization weakness in that interface rather than a memory-safety defect: the CVSS vector AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N describes a low-complexity attack launched from an adjacent network against a component that requires only low privileges and no user interaction, with scope unchanged but both confidentiality and integrity fully compromised and no availability impact. The adjacency (AV:A) and privilege (PR:L) prerequisites define two independent hurdles - network position on the physical communication segment hosting the Agile EDM instance and a valid low-privileged account - which is why the 7.3 base score is best read as a well-calibrated moderate rating rather than an internet-facing critical exposure.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Adjacent segment access gives AV:A, low-privileged authentication gives PR:L, full data read/modify yields C:H/I:H, and no availability impact yields A:N.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Engineering Communication Interface). The supported version that is affected is 6.2.1. Easily exploitable vulnerability allows low privileged attacker with access to the physical communication segment attached to the hardware where the Oracle Agile Engineering Data Management executes to compromise Oracle Agile Engineering Data Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Agile Engineering Data Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Agile Engineering Data Management accessible data. CVSS 3.1 Base Score 7.3 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
Executive ViewAI
Oracle Agile Engineering Data Management 6.2.1 contains a high-severity access-control flaw in its Engineering Communication Interface that can let an authenticated low-privileged user on the same network segment read or alter application data. This creates confidentiality and integrity risk for product engineering records, but exploitation requires local-segment access and valid credentials, and no public exploit identified at time of analysis. Leadership should prioritize only if the interface is exposed to shared or untrusted segments without strict network controls.
No vendor-released patch identified at time of analysis. Interim mitigations: isolate Engineering Communication Interface to a dedicated trusted VLAN; restrict adjacent network access via firewall/ACL to authorized hosts; disable the interface if not required; enforce least privilege and rotate credentials; implement 802.1X, port security, or private VLANs; monitor ECI and database activity for unauthorized reads/writes; audit and restore data integrity where needed.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB