CVE-2026-87262 in Agile Engineering Data Management
Summary
by MITRE • 09/16/2026
Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Engineering Communication Interface). The supported version that is affected is 6.2.1. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle Agile Engineering Data Management executes to compromise Oracle Agile Engineering Data Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Agile Engineering Data Management accessible data as well as unauthorized update, insert or delete access to some of Oracle Agile Engineering Data Management accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The Oracle Agile Engineering Data Management product, a critical component within the Oracle Supply Chain suite, contains a significant security flaw in its Engineering Communication Interface subsystem. This vulnerability specifically affects version 6.2.1 and represents a severe risk to organizations relying on this platform for managing engineering data and supply chain operations. The core issue stems from insufficient authentication mechanisms or validation checks within the communication interface that handles interactions between the application server and external systems or devices connected via physical network segments. Because the vulnerability allows exploitation by an unauthenticated attacker, it indicates a fundamental failure in enforcing access control policies at the protocol level for this specific component.
The attack vector associated with this flaw is classified as adjacent network (AV:A), meaning that while remote exploitation over the public internet may not be directly possible without additional pivoting or misconfiguration, any entity capable of accessing the physical communication segment attached to the hardware where Oracle Agile Engineering Data Management executes can exploit it. This typically includes attackers who have gained access to the local area network, such as through compromised endpoints within the corporate intranet, rogue devices plugged into switch ports, or insider threats with physical proximity to the infrastructure. The low complexity (AC:L) and lack of user interaction requirements (UI:N) further lower the barrier for exploitation, making this a high-risk vulnerability that can be triggered automatically by malicious scripts or tools once network access is established.
Successful exploitation of this vulnerability leads to severe consequences regarding data confidentiality and integrity. An attacker can achieve unauthorized access to critical business data stored within the Oracle Agile environment, potentially exposing sensitive intellectual property, supplier information, product designs, and manufacturing processes. Furthermore, the flaw permits unauthorized updates, inserts, or deletes against accessible data sets. This capability allows an adversary to alter engineering specifications, tamper with supply chain records, or delete essential configuration files, thereby compromising the integrity of business operations. The impact on availability is currently assessed as none in this specific CVSS assessment, but the potential for denial-of-service through data corruption remains a secondary risk if attackers choose to disrupt system functionality rather than steal or alter data.
From a classification perspective, this vulnerability aligns with CWE-287 Improper Authentication and CWE-915 Improper Modification of Objects by Concurrent Users depending on the specific mechanism exploited within the interface. In terms of offensive security frameworks, it maps to MITRE ATT&CK techniques related to Initial Access via Local Network or Lateral Movement if used as a stepping stone, specifically T1021 Remote Services if the adjacent network access is leveraged through shared services, and Data Manipulation under Impact categories such as T1565 Data Staging or T1489 Service Stop. The CVSS 3.1 base score of 7.1 reflects these high impacts on confidentiality and integrity with no impact on availability, emphasizing the need for immediate remediation to prevent data breaches and operational sabotage.
Mitigation strategies must focus on both technical controls and architectural changes. Immediate steps should include isolating the Oracle Agile Engineering Data Management servers into a dedicated, restricted VLAN that limits access only to authorized application components and management stations. Network segmentation is critical here, as it prevents adjacent network attackers from reaching the vulnerable interface. Additionally, implementing strict firewall rules to block unnecessary traffic on ports used by the Engineering Communication Interface can reduce the attack surface. Organizations should also ensure that all available patches or updates provided by Oracle are applied promptly if a fix exists for version 6.2.1. If patching is not immediately feasible, deploying intrusion detection systems with signatures targeting this specific vulnerability and monitoring for anomalous traffic patterns on the relevant network segments can provide an additional layer of defense. Regular audits of access controls and authentication mechanisms across all enterprise applications are essential to prevent similar misconfigurations in other critical systems.