This vulnerability affects Oracle Agile Engineering Data Management 6.2.1, specifically the Engineering Communication Interface component. An unauthenticated attacker with network access via HTTP can exploit this flaw to gain unauthorized update, insert, or delete access to some accessible data, as well as unauthorized read access to a subset of accessible data. The CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N, reflecting network attack vector, high attack complexity, no privileges or user interaction required, and limited confidentiality and integrity impact. Oracle has addressed this vulnerability in its August 2026 Critical Security Patch Update.

Successful exploitation can lead to unauthorized modification (update, insert, delete) and unauthorized reading of some data within Oracle Agile Engineering Data Management 6.2.1. The impact is limited to confidentiality and integrity with no impact on availability. The vulnerability is rated medium severity with a CVSS score of 4.8.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability. Customers are strongly advised to apply the available security patches promptly to mitigate the risk. No additional mitigation steps are specified beyond patching. Staying on actively supported versions and timely patch application is recommended by Oracle.