This vulnerability affects Oracle Agile Engineering Data Management version 6.2.1, specifically the Engineering Communication Interface component. An attacker with low privileges but physical access to the communication segment of the hardware where the product runs can exploit this flaw to gain unauthorized capabilities to create, delete, or modify critical or all accessible data within the system. The CVSS 3.1 vector (AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) reflects that the attack requires adjacent network access with low attack complexity and privileges, no user interaction, and results in high confidentiality and integrity impacts without affecting availability. Oracle has included this vulnerability in its September 2026 Critical Security Patch Update, indicating that a patch addressing this issue is available.

Exploitation of this vulnerability can result in unauthorized creation, deletion, or modification of critical data or all data accessible by Oracle Agile Engineering Data Management. This compromises the confidentiality and integrity of the data managed by the product. There is no impact on availability reported. The attack requires physical access to the communication segment attached to the hardware running the software and low privileges on the system.

Oracle has released a security patch for this vulnerability as part of its September 2026 Critical Security Patch Update. Customers running Oracle Agile Engineering Data Management version 6.2.1 should apply the available patch promptly to remediate this vulnerability. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay to prevent exploitation. No vendor advisory states that no action is required or that the issue is already mitigated without patching.