Agile Engineering Data Management Product Of Oracle Supply Chain
Monthly
Unauthorized read and write access to critical data in Oracle Agile Engineering Data Management 6.2.1 is achievable by low-privileged network attackers targeting the Engineering Communication Interface (ECI) component via HTTP, with successful exploitation yielding high confidentiality and integrity impact (C:H/I:H) that can cascade to additional Oracle products via scope change. The 'Authentication Bypass' tag in reporter intelligence suggests the flaw enables attackers to exceed their granted access level within the ECI, despite requiring an initial low-privileged foothold. Oracle addressed this in the August 2026 Critical Patch Update; no public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthorized data access in Oracle Agile Engineering Data Management 6.2.1 is achievable by unauthenticated network attackers via HTTP through the Engineering Communication Interface component. The flaw - tagged as an authentication bypass - permits limited confidentiality and integrity compromise, allowing unauthorized read of a subset of accessible data and unauthorized update, insert, or delete operations on some data. No active exploitation has been confirmed (no CISA KEV listing), and the high attack complexity (AC:H) materially constrains real-world exploitation.
Unauthorized read and write access to critical data in Oracle Agile Engineering Data Management 6.2.1 is achievable by low-privileged network attackers targeting the Engineering Communication Interface (ECI) component via HTTP, with successful exploitation yielding high confidentiality and integrity impact (C:H/I:H) that can cascade to additional Oracle products via scope change. The 'Authentication Bypass' tag in reporter intelligence suggests the flaw enables attackers to exceed their granted access level within the ECI, despite requiring an initial low-privileged foothold. Oracle addressed this in the August 2026 Critical Patch Update; no public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthorized data access in Oracle Agile Engineering Data Management 6.2.1 is achievable by unauthenticated network attackers via HTTP through the Engineering Communication Interface component. The flaw - tagged as an authentication bypass - permits limited confidentiality and integrity compromise, allowing unauthorized read of a subset of accessible data and unauthorized update, insert, or delete operations on some data. No active exploitation has been confirmed (no CISA KEV listing), and the high attack complexity (AC:H) materially constrains real-world exploitation.