This vulnerability affects Oracle Agile Engineering Data Management version 6.2.1, specifically in the Install component. It allows a low privileged attacker with network access via HTTP to compromise the system, but requires user interaction from a third party. The impact includes unauthorized creation, deletion, or modification of critical data, and unauthorized access to all data accessible by the product. The CVSS vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N) reflects network attack vector, high attack complexity, low privileges required, user interaction required, unchanged scope, and high confidentiality and integrity impacts with no availability impact. No official patch or remediation level is stated in the advisory, and no known exploits in the wild have been reported. The vendor advisory references Oracle's July 2026 Critical Patch Update but does not explicitly confirm a patch for this vulnerability.

Successful exploitation can result in unauthorized creation, deletion, or modification of critical data within Oracle Agile Engineering Data Management, as well as unauthorized access to all data accessible by the product. This compromises confidentiality and integrity but does not affect availability. The attack requires network access and user interaction, making exploitation difficult.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends applying security patches promptly and remaining on actively supported versions. Since no explicit patch or workaround is detailed for this vulnerability, monitoring Oracle advisories for updates is advised.