This vulnerability affects Oracle Agile Engineering Data Management version 6.2.1 and involves a denial of service condition exploitable by a low privileged attacker over the network via HTTP. The attacker can cause the application to hang or crash repeatedly, resulting in complete denial of service. The CVSS vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, no impact on confidentiality or integrity, and high impact on availability. The vulnerability is identified as CWE-400 (Uncontrolled Resource Consumption). The vendor advisory from Oracle (July 2026 Critical Patch Update) does not explicitly confirm a patch or remediation for this specific vulnerability but recommends applying available patches promptly.

Successful exploitation results in unauthorized ability to cause a hang or frequent crash of Oracle Agile Engineering Data Management, leading to complete denial of service. There is no impact on confidentiality or integrity of data. The vulnerability affects availability only.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends applying security patches without delay for all supported products. Until a specific patch is available for this vulnerability, monitor Oracle advisories for updates. No vendor advisory states that no action is required or that the issue is already mitigated.