CVE-2026-61190 in Agile Engineering Data Management
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Install). The supported version that is affected is 6.2.1. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Engineering Data Management. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Agile Engineering Data Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Agile Engineering Data Management accessible data. CVSS 3.1 Base Score 6.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle Agile Engineering Data Management version 6.2.1, specifically within the Install component of Oracle Supply Chain. The flaw represents a medium severity security weakness classified as a difficulty to exploit condition, requiring an attacker with low privilege levels and network access through HTTP protocols to initiate compromise attempts. The vulnerability's exploitation requires human interaction from individuals other than the attacker, suggesting that social engineering or user manipulation may be necessary components for successful exploitation. The CVSS 3.1 scoring system assigns a base score of 6.4, reflecting significant impacts to both confidentiality and integrity aspects of the affected system.
The technical nature of this vulnerability allows for unauthorized modification, creation, and deletion operations against critical data within Oracle Agile Engineering Data Management systems. Attackers who successfully exploit this weakness can gain complete access to all accessible data within the system, potentially compromising sensitive engineering data, product specifications, design documents, and other critical information managed through the platform. The vulnerability's impact extends beyond simple data theft to include potential data corruption and integrity violations that could severely disrupt engineering workflows and product development processes. This represents a serious concern for organizations relying on Agile Engineering Data Management for critical product lifecycle management.
The operational implications of this vulnerability are substantial, as it affects an installation component that likely handles system configuration and deployment operations. Organizations using Oracle Agile Engineering Data Management in production environments face potential data breaches where unauthorized parties could modify or delete engineering records, potentially leading to safety issues, compliance violations, or significant business disruption. The requirement for human interaction suggests that the attack vector may involve phishing campaigns or other social engineering tactics designed to trick legitimate users into performing actions that facilitate the exploitation process.
Mitigation strategies should focus on implementing network segmentation and access controls to limit exposure of the vulnerable installation component to untrusted networks. Organizations should ensure that all systems are updated with the latest Oracle security patches and advisories, as this vulnerability likely represents a known issue addressed through vendor releases. Network monitoring and intrusion detection systems should be configured to identify suspicious HTTP traffic patterns targeting the affected application components. Additionally, user awareness training programs should be implemented to reduce the risk of social engineering attacks that could leverage this vulnerability. The ATT&CK framework would classify this as a privilege escalation or persistence technique requiring user interaction, while CWE classification would likely involve weak input validation or improper access control mechanisms within the installation process. Organizations should also consider implementing application firewalls and web application security controls specifically designed to protect against HTTP-based attacks targeting enterprise engineering data management platforms.