CVE-2026-61195 in Agile Engineering Data Management
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Core). The supported version that is affected is 6.2.1. Easily exploitable vulnerability allows low privileged attacker with network access via TCP to compromise Oracle Agile Engineering Data Management. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Agile Engineering Data Management. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle Agile Engineering Data Management version 6.2.1, specifically within the Core component of Oracle Supply Chain. The flaw represents a significant security weakness that can be exploited by low-privileged attackers who gain network access through TCP connections. The vulnerability's accessibility is particularly concerning as it requires minimal privileges to exploit, making it attractive to attackers who may have limited initial access to the system. The attack vector operates over the network, meaning that an attacker does not need physical access or elevated credentials to attempt exploitation.
The technical nature of this vulnerability manifests as a complete denial of service condition that can result in either a hang or a frequently repeatable crash of the targeted Oracle Agile Engineering Data Management application. This type of vulnerability falls under the category of availability attacks, where the primary impact is the complete disruption of service rather than data compromise or privilege escalation. The CVSS 3.1 scoring system rates this vulnerability at 6.5 out of 10, with the high availability impact component reflecting the severity of potential service disruption that can affect business operations and productivity.
The operational implications of this vulnerability extend beyond simple service interruption to potentially cause significant business disruption within organizations using Oracle Agile Engineering Data Management for engineering data management processes. When an application becomes unavailable due to this type of denial of service attack, it can halt critical engineering workflows, delay product development cycles, and impact overall supply chain operations that depend on the availability of engineering data management systems. The vulnerability's ability to cause complete DOS conditions means that organizations may experience extended periods of unavailability until the issue is resolved through patches or other mitigations.
From a security framework perspective, this vulnerability aligns with CWE-400 which covers "Uncontrolled Resource Consumption" and potentially CWE-121 for buffer overflow conditions that could lead to denial of service. The attack pattern follows ATT&CK technique T1499 which involves network denial of service attacks targeting availability. Organizations should implement immediate mitigations including applying the latest security patches from Oracle, implementing network segmentation to limit access to the vulnerable application, and monitoring network traffic for suspicious patterns that may indicate exploitation attempts. Additionally, administrators should consider reducing the attack surface by disabling unnecessary network services and implementing proper access controls to limit who can connect to the Oracle Agile Engineering Data Management system.
The vulnerability demonstrates the importance of maintaining up-to-date security patches and monitoring for emerging threats within enterprise applications. Organizations relying on Oracle Agile Engineering Data Management must prioritize this patch deployment as a critical security measure, especially given the availability impact and the relatively low privilege requirements needed for exploitation. Regular security assessments and vulnerability scanning should be implemented to identify similar weaknesses in other components of the supply chain management infrastructure that may present comparable risks to business continuity and operational integrity.