This vulnerability affects Oracle Agile Engineering Data Management version 6.2.1, specifically in the Engineering Communication Interface component. It is difficult to exploit and requires the attacker to have low privileged logon access to the infrastructure hosting the product. Successful exploitation can lead to full compromise and takeover of the Oracle Agile Engineering Data Management application. The CVSS 3.1 vector indicates local attack vector (AV:L), high attack complexity (AC:H), low privileges required (PR:L), no user interaction (UI:N), unchanged scope (S:U), and high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H).

If exploited, an attacker with low privileged access to the infrastructure can fully compromise Oracle Agile Engineering Data Management, impacting confidentiality, integrity, and availability of the system. This could result in unauthorized access to sensitive engineering data and disruption of operations.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability among many others. Customers are strongly advised to apply the available security patches promptly to mitigate this vulnerability. No indication was given that the vulnerability is already mitigated or requires no action. Patch status is confirmed by the vendor advisory. Users should refer to Oracle's official Critical Security Patch Update documentation for installation instructions.