This vulnerability in Oracle Agile Engineering Data Management 6.2.1 involves a flaw in the Web Services Security component that can be exploited remotely by an attacker with low privileges and network access over HTTP. Successful exploitation can lead to complete compromise of the product, affecting confidentiality, integrity, and availability. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on all three security properties. Oracle has acknowledged this issue in its August 2026 Critical Security Patch Update advisory and strongly recommends applying patches promptly.

The vulnerability allows an attacker with low privileges and network access via HTTP to fully compromise Oracle Agile Engineering Data Management 6.2.1. This includes complete loss of confidentiality, integrity, and availability of the affected system. Such a compromise could lead to unauthorized data access, modification, and denial of service within the product environment.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability. Customers are strongly advised to apply the official patch promptly to mitigate the risk. Oracle emphasizes remaining on actively supported versions and applying security patches without delay. No alternative mitigations or workarounds are specified in the advisory.