CVE-2026-61194 in Agile Engineering Data Management
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Core). The supported version that is affected is 6.2.1. Easily exploitable vulnerability allows low privileged attacker with network access via TCP to compromise Oracle Agile Engineering Data Management. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Agile Engineering Data Management. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability exists within Oracle Agile Engineering Data Management version 6.2.1, specifically within the Core component of Oracle Supply Chain products. The flaw represents a significant security weakness that can be exploited by attackers with minimal privileges and network access through TCP connections. The vulnerability's ease of exploitation makes it particularly dangerous as it requires no specialized skills or advanced techniques to leverage. The affected system operates under the assumption that legitimate network connections should be trusted, creating an attack surface where unauthorized users can manipulate system resources through carefully crafted network requests.
The technical nature of this vulnerability manifests as a complete denial of service condition that can cause either a system hang or repeated crashes that effectively render the application unavailable to authorized users. This type of vulnerability falls under the Common Weakness Enumeration category of insufficient input validation, specifically CWE-20 which addresses weaknesses related to improper handling of input data that can lead to system instability and availability issues. The vulnerability's impact on system availability stems from the fact that attackers with low privileges can trigger memory corruption or resource exhaustion conditions within the application's core processing mechanisms.
From an operational perspective, this vulnerability creates substantial risk for organizations relying on Oracle Agile Engineering Data Management for their engineering data management processes. The complete denial of service condition means that critical engineering workflows and data access capabilities become unavailable, potentially disrupting entire project timelines and collaborative development activities. The CVSS 3.1 base score of 6.5 indicates a medium to high severity impact, with the availability impact being particularly severe as it directly affects system functionality and business operations. Organizations using this software version may experience significant downtime and productivity losses while remediation efforts are implemented.
The attack vector requires only network access via TCP connections, making it accessible from external networks or internal threat actors who have gained basic network connectivity to the target system. This accessibility profile aligns with ATT&CK technique T1190 which involves exploiting vulnerabilities in network services to gain unauthorized access and control over systems. The low privilege requirement means that attackers do not need administrative or elevated access rights to exploit this weakness, making it particularly concerning for environments where access controls may be insufficiently enforced. Organizations should consider implementing additional network segmentation and monitoring to detect potential exploitation attempts.
Mitigation strategies should include immediate application of Oracle's security patches and updates specifically addressing this vulnerability in the Agile Engineering Data Management 6.2.1 release. Network administrators should implement firewall rules and access control lists to restrict TCP connections to only trusted sources and monitor for unusual traffic patterns that might indicate exploitation attempts. Additionally, organizations should consider implementing intrusion detection systems that can identify potential denial of service attack patterns targeting the affected application. Regular security assessments and vulnerability scanning should be conducted to ensure comprehensive protection against similar vulnerabilities in other components of the Oracle Supply Chain suite. The remediation process should also include reviewing and strengthening access controls to minimize the risk of unauthorized network access to critical systems.