EUVD-2026-79913
GHSA-gp29-84r4-pc2r
Severity by source
AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Adjacent segment access gives AV:A, low-privileged authentication gives PR:L, full data read/modify yields C:H/I:H, and no availability impact yields A:N.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Engineering Communication Interface). The supported version that is affected is 6.2.1. Easily exploitable vulnerability allows low privileged attacker with access to the physical communication segment attached to the hardware where the Oracle Agile Engineering Data Management executes to compromise Oracle Agile Engineering Data Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Agile Engineering Data Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Agile Engineering Data Management accessible data. CVSS 3.1 Base Score 7.3 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
AnalysisAI
Authenticated users with access to the same physical communication segment as the server can abuse the Engineering Communication Interface in Oracle Agile Engineering Data Management 6.2.1 to bypass intended access controls and read or alter application data, producing high confidentiality and integrity impact. The vulnerability is rated CVSS 3.1 7.3 (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), meaning an attacker must already hold low-privileged credentials and be positioned on the adjacent network segment rather than reaching the service over the internet, and no user interaction is required on the victim's part. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the attacker to have access to the physical communication segment attached to the hardware running Oracle Agile Engineering Data Management 6.2.1 (AV:A - not remotely internet-exploitable) AND to hold at least low-privileged authenticated access (PR:L) to the application; exploitation targets the Engineering Communication Interface component. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuinely moderate-risk issue rather than an inflated high-CVSS finding, and the 7.3 base score is well-calibrated. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch version is identified in the available data, so the authoritative fix must be taken from Oracle's security alert at https://www.oracle.com/security-alerts/cspusep2026.html (Oracle CPU/advisory channel) - applying the corresponding Agile Engineering Data Management 6.2.1 update as soon as Oracle publishes it, and validating version state before and after deployment, is the primary action. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Oracle Agile Engineering Data Management 6.2.1 instances with the Engineering Communication Interface enabled, isolate or disable the interface where not required, and restrict adjacent-network access to a dedicated trusted management VLAN with firewall/ACL rules limited to authorized engineering hosts; enforce least privilege and review accounts that could reach the same segment. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today