CVE-2026-101734 in Agile Engineering Data Management
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Engineering Communication Interface). The supported version that is affected is 6.2.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Engineering Data Management. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Agile Engineering Data Management accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The Oracle Agile Engineering Data Management product, specifically within the Supply Chain module's Engineering Communication Interface component in version 6.2.1, contains a security flaw that permits unauthorized data access. This vulnerability is classified under CWE-89 for SQL Injection or potentially CWE-200 for Information Exposure depending on the specific implementation details of the interface handling user input. The core technical issue stems from insufficient validation and sanitization of HTTP requests processed by the Engineering Communication Interface, allowing an attacker to manipulate queries or data retrieval mechanisms without proper authorization checks.
An attacker with low privileges who has network access via HTTP can exploit this flaw to compromise the integrity of the application's security model. Because the vulnerability is easily exploitable and does not require user interaction, it presents a significant risk in environments where internal users have limited administrative rights but standard network connectivity. The attack vector relies on sending crafted HTTP requests that bypass existing authentication or authorization controls, effectively allowing the attacker to query sensitive data stores directly through the vulnerable interface endpoint.
The operational impact of this vulnerability is primarily focused on confidentiality rather than integrity or availability. Successful exploitation results in unauthorized read access to a subset of Oracle Agile Engineering Data Management accessible data. This means that while an attacker cannot modify system configurations or disrupt service operations, they can extract sensitive engineering specifications, project details, or proprietary design information stored within the database. The CVSS 3.1 base score of 4.3 reflects this limited scope of impact, categorized as medium severity due to the network-based attack vector and low complexity but constrained by the requirement for low-privileged access and the lack of broader system compromise capabilities.
From a threat intelligence perspective, this vulnerability aligns with ATT&CK techniques related to Initial Access via Valid Accounts or Exploitation for Credential Access if credentials are harvested, though in this specific case, it is more accurately mapped to Data Exfiltration over Application Protocol since the attacker reads data directly through HTTP. The vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N indicates that while the attack requires low privileges and no user interaction, the scope remains unchanged as it does not affect other components beyond the immediate application layer.
To mitigate this risk, organizations should immediately apply the latest security patches provided by Oracle for version 6.2.1 of Agile Engineering Data Management. If patching is not immediately feasible, network segmentation strategies should be employed to restrict HTTP access to the vulnerable component only from trusted internal subnets. Additionally, implementing a Web Application Firewall with rules specifically targeting SQL injection patterns or anomalous query structures in the Engineering Communication Interface can provide an additional layer of defense. Regular audits of user permissions and enforcement of least-privilege principles are also critical to minimizing the potential impact if such vulnerabilities are exploited in the future.