CVE-2026-87260 in Agile Engineering Data Management
Summary
by MITRE • 09/16/2026
Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Engineering Communication Interface). The supported version that is affected is 6.2.1. Easily exploitable vulnerability allows low privileged attacker with access to the physical communication segment attached to the hardware where the Oracle Agile Engineering Data Management executes to compromise Oracle Agile Engineering Data Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Agile Engineering Data Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Agile Engineering Data Management accessible data. CVSS 3.1 Base Score 7.3 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/16/2026
The Oracle Agile Engineering Data Management product, a critical component within the Oracle Supply Chain suite, contains a significant security flaw in its Engineering Communication Interface subsystem affecting version 6.2.1. This vulnerability stems from insufficient access controls and validation mechanisms inherent to how the system handles incoming data requests over physical communication segments. The core technical issue lies in the failure of the application layer to adequately authenticate or authorize low-privileged users who have gained network-level proximity to the hardware hosting the service. By exploiting this weakness, an attacker can bypass standard security boundaries that are typically enforced at higher privilege levels or through remote network vectors, effectively treating local physical access as a trusted state for administrative operations.
The operational impact of this vulnerability is severe due to its high potential for data compromise and system manipulation. A successful exploitation allows an attacker with low privileges on the local network segment to execute unauthorized actions that directly affect both confidentiality and integrity. Specifically, the flaw enables the creation, deletion, or modification of critical engineering data stored within the database managed by Oracle Agile Engineering Data Management. This means sensitive intellectual property, design specifications, and supply chain configurations can be altered or exfiltrated without detection. Furthermore, because the vulnerability grants access to all accessible data rather than just specific records, it effectively results in a complete compromise of the information assets protected by this module, leading to potential regulatory violations and significant business disruption.
From a classification perspective, this flaw aligns with CWE-269 Improper Privilege Management and CWE-732 Incorrect Permission Assignment for Critical Resource, as the system fails to enforce appropriate access controls relative to the user's actual privilege level or physical location context. In terms of offensive security tactics, this vulnerability facilitates lateral movement and data exfiltration techniques described in the MITRE ATT&CK framework under Local Privilege Escalation and Data from Information Repositories. The attack vector is classified as Adjacent Network (AV:A), indicating that while it does not require direct physical touch at the server console, it requires being on the same local network segment or broadcast domain where the vulnerable service resides. This distinction highlights a common architectural risk in industrial control systems and enterprise resource planning environments where internal networks are often trusted implicitly without sufficient micro-segmentation or deep packet inspection.
Mitigation strategies must address both immediate technical controls and long-term architectural improvements. Oracle has likely released patches for version 6.2.1 that enforce stricter authentication checks on the Engineering Communication Interface endpoints. Organizations should immediately apply these vendor-supplied updates to close the privilege escalation gap. In addition to patching, network segmentation is critical; administrators should isolate systems running vulnerable versions of Oracle Agile from general user networks using firewalls or VLANs to restrict access only to authorized application servers and management consoles. Implementing strict firewall rules that limit inbound traffic on relevant ports to specific IP addresses can significantly reduce the attack surface for adjacent network attackers. Furthermore, deploying intrusion detection systems tuned to detect anomalous data modification patterns in engineering databases can provide early warning of exploitation attempts. Regular audits of user permissions ensure that low-privileged accounts do not possess unnecessary access rights to sensitive communication interfaces, adhering to the principle of least privilege essential for securing critical supply chain infrastructure.