CVE-2026-61187 in Agile Engineering Data Management
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Install). The supported version that is affected is 6.2.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Agile Engineering Data Management executes to compromise Oracle Agile Engineering Data Management. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Agile Engineering Data Management. CVSS 3.1 Base Score 2.8 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability exists within Oracle Agile Engineering Data Management version 6.2.1, specifically in the installation component of Oracle Supply Chain products. The flaw represents a low-severity security weakness that can be exploited by attackers who already possess legitimate login credentials to the system infrastructure where the application operates. The vulnerability's exploitability requires minimal technical sophistication as it only necessitates a single logon session to the target environment, making it particularly concerning for organizations with compromised accounts or insider threats.
The technical nature of this vulnerability stems from insufficient access controls within the installation process of the Agile Engineering Data Management system. Attackers with low privileges can leverage their existing infrastructure access to compromise the application's integrity and availability. The requirement for human interaction from someone other than the attacker indicates that while the initial exploitation may be automated, some form of user involvement is necessary for successful execution. This suggests the vulnerability might involve a social engineering component or require specific user actions after initial system access has been established.
From an operational impact perspective, this vulnerability manifests as a partial denial of service condition that affects the availability of Oracle Agile Engineering Data Management services. The cvss base score of 2.8 indicates a low to medium severity impact with availability being the primary concern rather than confidentiality or integrity breaches. The partial denial of service means that while the system may not be completely inaccessible, certain functionalities could become impaired or unavailable, potentially disrupting engineering data management workflows and production processes that depend on this platform for product development and documentation management.
Organizations should implement several mitigation strategies to address this vulnerability including enhanced monitoring of system access logs for suspicious activities, implementing principle of least privilege access controls, and conducting regular security assessments of their Agile Engineering Data Management installations. The vulnerability's classification under cvss vector av:l/ac:l/pr:l/ui:r/s:u/c:n/i:n/a:l aligns with common weakness enumerations related to insufficient access control mechanisms and improper privilege management as outlined in cwe standards. Security teams should also consider implementing additional authentication layers and automated threat detection systems to identify potential exploitation attempts. Regular patching and updating of the Oracle Agile Engineering Data Management platform remains essential to address known vulnerabilities and maintain system integrity against evolving threats.
The attack surface for this vulnerability is particularly concerning given that it requires minimal privileges to exploit, suggesting that organizations with compromised accounts or insider threats could potentially leverage this weakness to disrupt critical engineering data management processes. System administrators should review their current access control policies and ensure that all users have appropriate authorization levels based on their roles within the organization. Additional network segmentation and application-level security controls can help reduce the potential impact of such vulnerabilities by limiting lateral movement capabilities for attackers who gain initial access through compromised accounts.