This vulnerability affects Oracle Agile Engineering Data Management version 6.2.1, specifically in the Engineering Communication Interface component. It requires a high privileged attacker with logon access to the infrastructure where the product runs. Exploitation is difficult and necessitates human interaction from a third party. If successfully exploited, the attacker can take over the Oracle Agile Engineering Data Management system. The CVSS 3.1 vector is AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H, reflecting local attack vector, high attack complexity, high privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability.

The vulnerability can lead to complete compromise of Oracle Agile Engineering Data Management, impacting confidentiality, integrity, and availability of the system. However, exploitation is difficult and requires both high privileges and user interaction, limiting the likelihood of successful attacks. No known exploits in the wild have been reported.

Oracle has included this vulnerability in its August 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant security patches promptly. The vendor advisory emphasizes staying on actively supported versions and applying patches without delay to mitigate exploitation risks. No specific patch version for Oracle Agile Engineering Data Management 6.2.1 is detailed in the advisory, so users should consult Oracle's official patch documentation for this product and version.