The vulnerability in Oracle Agile Engineering Data Management allows a local attacker with logon credentials to exploit a flaw in the Engineering Communication Interface, enabling full compromise of the system. This low‑privilege attack can lead to complete takeover, affecting confidentiality, integrity, and availability for the affected instance. The flaw is a form of improper access control, leading to critical impact on the application and potentially exposing sensitive supply‑chain data.

The affected system is Oracle Agile Engineering Data Management version 6.2.1, part of Oracle Supply Chain. The vulnerability resides in the Engineering Communication Interface component.

The CVSS base score of 7.0 indicates a high risk from a technical standpoint. Although an EPSS score is not available and the flaw is not listed in the CISA KEV catalog, the need for local logon access limits the threat to environments where attackers have physical or remote access to the server. Despite this, the potential for complete takeover warrants prompt remediation.