This vulnerability affects Oracle Agile Engineering Data Management version 6.2.1, specifically in the Engineering Communication Interface component. It is easily exploitable by a low privileged attacker who has logon access to the infrastructure where the product runs. Successful exploitation can lead to unauthorized access to critical data and unauthorized update, insert, or delete operations on some accessible data. The vulnerability has a CVSS 3.1 vector of AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N, reflecting local attack vector, low complexity, low privilege required, no user interaction, scope change, high confidentiality impact, low integrity impact, and no availability impact. Oracle’s September 2026 Critical Security Patch Update includes patches addressing this vulnerability.

Exploitation of this vulnerability can result in unauthorized access to critical data within Oracle Agile Engineering Data Management and unauthorized modification (update, insert, delete) of some accessible data. The scope of impact may extend to additional Oracle products due to the interconnected nature of the environment. The confidentiality impact is high, integrity impact is low, and availability is not affected.

Oracle has released a security patch for this vulnerability as part of the September 2026 Critical Security Patch Update. Users of Oracle Agile Engineering Data Management version 6.2.1 should apply the patch promptly to remediate the vulnerability. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay to prevent exploitation.