This vulnerability affects Oracle Agile Engineering Data Management version 6.2.1 and is exploitable remotely without authentication over HTTP. It permits attackers to compromise the system by unauthorized creation, deletion, or modification of critical data, unauthorized partial data disclosure, and denial of service through system crashes. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H) reflects network attack vector, low attack complexity, no privileges or user interaction required, and significant impacts on integrity and availability. The vendor advisory from Oracle (July 2026 Critical Patch Update) lists this vulnerability among many others but does not explicitly confirm a patch or remediation status for this specific issue. Oracle strongly urges customers to apply security patches without delay and remain on actively supported versions.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or all accessible data within Oracle Agile Engineering Data Management. It also allows unauthorized read access to some data and can cause a denial of service by hanging or crashing the system. This results in confidentiality, integrity, and availability impacts rated as high severity.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory (https://www.oracle.com/security-alerts/cpujul2026.html) for current remediation guidance. Oracle recommends applying all relevant security patches promptly and remaining on actively supported product versions. No specific temporary mitigations or workarounds are provided in the advisory.