This vulnerability affects Oracle Agile Engineering Data Management 6.2.1, specifically the Engineering Communication Interface component. An attacker who can access the physical communication segment connected to the hardware where the product runs can exploit this flaw without authentication. The impact includes unauthorized access to critical data and limited unauthorized modification of data. The CVSS vector indicates the attack requires adjacent network access (AV:A), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), unchanged scope (S:U), high confidentiality impact (C:H), low integrity impact (I:L), and no availability impact (A:N). Oracle has included this vulnerability in its September 2026 Critical Security Patch Update, which provides patches for this and many other vulnerabilities.

The vulnerability allows an unauthenticated attacker with physical network access to gain unauthorized access to critical data within Oracle Agile Engineering Data Management and perform unauthorized data modifications such as updates, inserts, or deletions. This compromises confidentiality and integrity of the affected system's data. There is no reported impact on availability. No known exploits are reported in the wild at this time.

Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant patches promptly to remediate this issue. The affected version is 6.2.1, and applying the official patch from Oracle is the recommended mitigation. Since this vulnerability requires physical access to the communication segment, restricting physical network access can also reduce risk. Patch status is confirmed by the Oracle advisory.