This vulnerability affects Oracle Agile Engineering Data Management version 6.2.1 and allows an unauthenticated attacker with network access via HTTP to perform unauthorized actions including creation, deletion, modification, and reading of data, as well as causing denial of service by crashing or hanging the system. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H) indicates network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality (low), integrity (high), and availability (high). The vendor advisory from Oracle (July 2026 Critical Patch Update) lists this product and version as affected but does not explicitly confirm patch availability or remediation level for this specific vulnerability. Oracle advises customers to remain on supported versions and apply patches without delay. No known exploits in the wild have been reported.

Successful exploitation can result in unauthorized creation, deletion, or modification of critical or accessible data within Oracle Agile Engineering Data Management. It can also lead to unauthorized read access to some data and cause denial of service by hanging or crashing the application. The vulnerability impacts confidentiality, integrity, and availability, with a CVSS score of 9.4 indicating critical severity.

Patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until an official patch is confirmed and applied, restrict network access to the affected service where possible to reduce exposure.