This vulnerability affects Oracle Agile Engineering Data Management version 6.2.1 and involves a security flaw in the Install component. An attacker with low privileges and network access via HTTP can exploit this vulnerability, but successful exploitation requires user interaction from a third party. The impact includes unauthorized creation, deletion, or modification of critical data and unauthorized access to all data accessible by the product. The CVSS 3.1 vector is AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N, reflecting network attack vector, high attack complexity, low privileges required, user interaction needed, unchanged scope, and high confidentiality and integrity impact without availability impact. The vendor advisory does not explicitly confirm a patch or remediation for this specific vulnerability but references the July 2026 Critical Patch Update containing numerous patches for Oracle products. No known exploits in the wild have been reported.

Successful exploitation can result in unauthorized creation, deletion, or modification of critical data within Oracle Agile Engineering Data Management, as well as unauthorized access to all data accessible by the product. This compromises confidentiality and integrity of the data but does not affect availability. The attack requires network access and user interaction, limiting ease of exploitation.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory for current remediation guidance at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until a patch is confirmed and applied, limit network exposure of Oracle Agile Engineering Data Management and educate users to be cautious of unsolicited interactions that could trigger exploitation.