This vulnerability affects Oracle Agile Engineering Data Management version 6.2.1, specifically in the Engineering Communication Interface component. It permits a low privileged attacker who has logon access to the infrastructure where the product runs to compromise the system. The scope of impact extends beyond the product itself, potentially affecting additional Oracle products. Successful exploitation can result in unauthorized creation, deletion, or modification of critical data, with high confidentiality and integrity impacts but no availability impact. The CVSS vector is AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update.

Exploitation of this vulnerability can lead to unauthorized creation, deletion, or modification of critical data within Oracle Agile Engineering Data Management and potentially other related Oracle products. The confidentiality and integrity of data are severely impacted, while availability is not affected. This could compromise critical business processes relying on the integrity of this data.

Oracle has released a security patch for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers are strongly advised to apply the available patches promptly to mitigate the risk. Oracle recommends remaining on actively supported versions and applying security patches without delay. No alternative mitigations or workarounds are specified in the advisory.