A flaw in the Oracle Agile Engineering Data Management product allows a low‑privileged attacker who can log on to the infrastructure where the software runs to gain unauthorized create, update, delete or read permissions on the data it manages. The vulnerability can be exploited to alter or delete existing records or to add new ones, as well as to read sensitive data that should be restricted. This exposes the confidentiality and integrity of the data stored within the application.

Oracle products affected by this vulnerability are Oracle Agile Engineering Data Management version 6.2.1. The flaw exists in the Engineering Communication Interface component of the Oracle Supply Chain suite. No other versions or product lines are listed as affected.

The CVSS score of 3.6 indicates moderate impact but limited attack complexity and requires local access. Exploitation would necessitate a user who can log into the host system; there is no remote vector. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting low to moderate likelihood of exploitation. If an attacker obtains low‑privilege access, they can perform unauthorized data modifications and reads, potentially compromising business processes and data integrity.