This vulnerability affects Oracle Agile Engineering Data Management version 6.2.1 and allows a low privileged attacker who has logon access to the infrastructure where the product runs to compromise it. The attack can result in unauthorized access to critical or all accessible data within the product. The CVSS 3.1 vector indicates the attack requires local access (AV:L), low attack complexity (AC:L), low privileges (PR:L), no user interaction (UI:N), scope change (S:C), and impacts confidentiality (C:H) without affecting integrity or availability. The vendor advisory from Oracle does not explicitly confirm a patch or remediation level for this specific vulnerability but references a Critical Patch Update containing many patches. Users are advised to consult the vendor advisory for patch availability.

The vulnerability allows unauthorized access to critical data or complete access to all data accessible by Oracle Agile Engineering Data Management 6.2.1. This confidentiality impact can lead to significant data exposure within the affected environment. The scope change indicates that other Oracle products integrated or dependent on this product may also be impacted by successful exploitation.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until a patch is confirmed and applied, restrict logon access to the infrastructure hosting Oracle Agile Engineering Data Management and monitor for unauthorized access attempts.