CVE-2026-61186
CriticalCVSS 9.4Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
Vulnerability in Oracle Agile Engineering Data Management (Install component) allows an unauthenticated attacker via HTTP to unauthorizedly create, delete, or modify critical data and read a subset of data. It may also cause a hang or frequent crash (DOS).
Risk Assessment
Risk is critical (CVSS 9.4) – an attacker can compromise data integrity and availability, potentially leading to system downtime and data loss.
Recommendation
Apply the Oracle patch for version 6.2.1 immediately. Restrict HTTP access to trusted networks only.
Other vulnerabilities in Oracle Agile Engineering Data Management
See all- CVE-2016-5518High
Unspecified vulnerability in the Oracle Agile Engineering Data Management component in Oracle Supply Chain Products Suite 6.1.3.0 and 6.2.0.0 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to webfileservices.
- CVE-2016-3468Critical
Unspecified vulnerability in the Oracle Agile Engineering Data Management component in Oracle Supply Chain Products Suite 6.1.3.0 and 6.2.0.0 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Install.
- CVE-2026-87262High
Vulnerability in Oracle Agile Engineering Data Management (component: Engineering Communication Interface) affecting version 6.2.1. An easily exploitable flaw allows an unauthenticated attacker with access to the physical communication segment to gain unauthorized access to data and to update, insert or delete it.
- CVE-2026-87261High
Vulnerability in Oracle Agile Engineering Data Management (component: Engineering Communication Interface) affecting version 6.2.1. An easily exploitable flaw allows a low privileged attacker with logon to gain unauthorized access to data and to update, insert or delete it, and the attack may significantly impact additional products (scope change).
- CVE-2026-87260High
Vulnerability in Oracle Agile Engineering Data Management (component: Engineering Communication Interface) affecting version 6.2.1. An easily exploitable flaw allows a low privileged attacker with access to the physical communication segment to create, delete or modify data and gain unauthorized access to it.
- CVE-2026-87259High
Vulnerability in Oracle Agile Engineering Data Management (component: Engineering Communication Interface) affecting version 6.2.1. An easily exploitable flaw allows a low privileged attacker with logon to create, delete or modify data and gain unauthorized access to it, and the attack may significantly impact additional products (scope change).
- CVE-2026-71053High
Vulnerability in Oracle Agile Engineering Data Management (component: Web Services Security) affects version 6.2.1. An unauthenticated attacker can via HTTP, under difficult conditions, take over the product. CVSS 8.1.
- CVE-2026-71052High
Vulnerability in Oracle Agile Engineering Data Management (component: Web Services Security) affects version 6.2.1. A low-privileged attacker can via HTTP take over the product. CVSS 8.8.
- CVE-2026-70712Medium
Vulnerability in Oracle Agile Engineering Data Management (component: Install) version 6.2.1. Difficult to exploit, requires high privileged attacker with local access, allows takeover of the system.
- CVE-2026-70709Medium
Vulnerability in Oracle Agile Engineering Data Management (component: Engineering Communication Interface) version 6.2.1. Difficult to exploit, allows unauthenticated attacker via HTTP to unauthorized update, insert or delete of some data and read access to a subset of data.
Original NVD description (English source)
Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Install). The supported version that is affected is 6.2.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile Engineering Data Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Agile Engineering Data Management accessible data as well as unauthorized read access to a subset of Oracle Agile Engineering Data Management accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Agile Engineering Data Management. CVSS 3.1 Base Score 9.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H).