CVE-2026-61191 in Agile Engineering Data Management
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Document Management). The supported version that is affected is 6.2.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Agile Engineering Data Management executes to compromise Oracle Agile Engineering Data Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Agile Engineering Data Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Agile Engineering Data Management. CVSS 3.1 Base Score 4.4 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability exists within Oracle Agile Engineering Data Management version 6.2.1, specifically in the Document Management component of the Oracle Supply Chain suite. The flaw represents a critical security weakness that can be exploited by attackers with minimal privileges who have already gained access to the system infrastructure where the application runs. The vulnerability's exploitability is classified as easily accessible, meaning that an attacker with low-privileged access to the underlying infrastructure can leverage this weakness to compromise the targeted application. This type of vulnerability falls under the category of privilege escalation and lateral movement attacks, which are commonly addressed through the ATT&CK framework under techniques such as privilege escalation and defense evasion.
The technical nature of this vulnerability stems from insufficient access controls or authentication mechanisms within the Document Management component that allows unauthorized modifications to data stored within the Oracle Agile system. The CVSS 3.1 score of 4.4 indicates a moderate severity level with specific impacts to integrity and availability. The attack vector is classified as local (AV:L) suggesting that exploitation requires physical or network access to the server where Oracle Agile Engineering Data Management operates, while the low complexity requirement (AC:L) indicates that no specialized skills are needed to carry out the attack. The privilege requirement of low (PR:L) means that an attacker who already has basic system access can exploit this vulnerability without needing elevated privileges.
The operational impact of successful exploitation includes unauthorized ability to update, insert, or delete data within the Oracle Agile Engineering Data Management system, which compromises data integrity and potentially exposes sensitive engineering information. Additionally, attackers can cause partial denial of service conditions that disrupt normal operations of the application. This partial DOS capability affects availability by making certain functionalities inaccessible to legitimate users while leaving other components operational. The vulnerability's potential to affect both integrity and availability aligns with common security principles where data modification capabilities often provide pathways for service disruption.
Organizations should implement several mitigation strategies to address this vulnerability including immediate patching of the Oracle Agile Engineering Data Management system to version 6.2.1 or later releases that contain the necessary security fixes. Network segmentation should be enforced to limit access to the application servers and reduce the attack surface available to potential adversaries. Access controls must be strictly enforced at both network and application levels to ensure that only authorized personnel can interact with the system. System monitoring should be enhanced to detect unusual activities that might indicate exploitation attempts, particularly around data modification operations in the Document Management component. Security configuration reviews should be conducted to ensure that unnecessary services or accounts are disabled and that proper least privilege principles are applied. The vulnerability's classification under CWE categories related to insufficient access control and improper privilege management further emphasizes the need for comprehensive access governance measures. Organizations should also consider implementing application firewalls and intrusion detection systems specifically configured to monitor for attacks targeting Oracle Agile applications, as these tools can provide additional layers of protection against exploitation attempts.