Oracle Agile Engineering Data Management exposes a vulnerability in the Engineering Communication Interface component, allowing an unauthenticated attacker who can reach the physical communication segment of the system’s hardware to compromise the application and access critical data. The flaw does not grant system compromise or denial of service but does allow full read access to any data stored in the application, directly impacting confidentiality. The CVSS score of 5.3 reflects the medium severity of this unauthorized data disclosure.

The affected vendor is Oracle Corporation, specifically the Agile Engineering Data Management product. Version 6.2.1 is listed as the only affected release. No additional versions or variants are disclosed.

The vulnerability requires physical access to the communication interface; therefore the attack vector is neither remote nor network-based but depends on physical proximity. No exploit code has been publicly released and the EPSS score is 0.00181 (<1%), suggesting low exploitation probability from publicly motivated actors. As the vulnerability is not listed in CISA’s KEV catalog, it likely has not been widely exploited in the wild. Nonetheless, it is a medium risk if the physical communication segment is not adequately secured, because an attacker who gains that level of access could read all data housed in Oracle Agile Engineering Data Management.