This vulnerability affects Oracle Agile Engineering Data Management version 6.2.1 and allows a low privileged attacker who has logon access to the infrastructure where the product runs to compromise the product. The scope of impact may extend to additional Oracle products due to the nature of the compromise. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) indicates local attack vector, low attack complexity, low privileges required, no user interaction, scope changed, high confidentiality impact, and no integrity or availability impact. Oracle has published a Critical Patch Update advisory in July 2026 covering many vulnerabilities but does not explicitly confirm a patch for this CVE. Customers are advised to remain on supported versions and apply patches promptly once available.

Successful exploitation can result in unauthorized access to critical data or complete access to all data accessible by Oracle Agile Engineering Data Management. The confidentiality impact is high, but there is no impact on integrity or availability. The vulnerability requires local access with low privileges and has low attack complexity. The scope of the vulnerability is changed, meaning it may affect additional Oracle products beyond the Agile Engineering Data Management component.

Patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends applying security patches promptly and staying on actively supported versions. Until a patch is confirmed and applied, restrict access to the infrastructure hosting Oracle Agile Engineering Data Management to trusted users only and monitor for suspicious activity related to this product.