This vulnerability affects Oracle Agile Engineering Data Management version 6.2.1, specifically in the Engineering Communication Interface component. It allows a low privileged attacker with network access via HTTP to compromise the system, resulting in unauthorized creation, deletion, or modification of critical data, and unauthorized access to all accessible data. The CVSS 3.1 vector is AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N, reflecting network attack vector, high attack complexity, low privileges required, no user interaction, scope change, and high confidentiality and integrity impacts without availability impact. Oracle's August 2026 Critical Security Patch Update addresses this vulnerability among many others, and customers are strongly advised to apply the patches to mitigate risk.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Agile Engineering Data Management, as well as unauthorized access to all data accessible by the product. This compromises confidentiality and integrity of data but does not affect availability. The vulnerability also has a scope change, meaning it may impact additional Oracle products beyond Agile Engineering Data Management.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability. Customers should apply the official patches provided by Oracle without delay. Oracle strongly recommends remaining on actively supported versions and promptly applying security patches to prevent exploitation. No additional mitigation steps are specified beyond applying the official patch.