Description
Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Engineering Communication Interface). The supported version that is affected is 6.2.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile Engineering Data Management. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Agile Engineering Data Management accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
Published: 2026-10-20
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Read
Action: Apply Patch
AI Analysis

Impact

Vulnerability in the Engineering Communication Interface of Oracle Agile Engineering Data Management (version 6.2.1) permits an unauthenticated attacker with network access to read a subset of data via HTTP. The flaw allows only read access without authentication; no escalation of privileges or higher damage is envisaged. It is rated CVSS 3.1 base 5.3, reflecting a low confidentiality impact.

Affected Systems

Affected product is Oracle Agile Engineering Data Management, version 6.2.1, part of Oracle Supply Chain. The vulnerable component is Engineering Communication Interface. Only this version is affected.

Risk and Exploitability

The vulnerability is exploitable over HTTP from any network, requiring no credentials. The CVSS score of 5.3 indicates moderate risk, while the EPSS score is not available and it is not listed in the CISA KEV catalog. Attacks would only allow unauthorized read of a subset of accessible data, with no privilege escalation or denial‑of‑service potential.

Generated by OpenCVE AI on October 21, 2026 at 01:46 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply any available Oracle patch or upgrade to a version newer than 6.2.1.
  • Restrict HTTP access to the Engineering Communication Interface so that only trusted IPs can reach the service.
  • Enable detailed logging and regularly review logs for suspicious read access attempts.

Generated by OpenCVE AI on October 21, 2026 at 01:46 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 21 Oct 2026 02:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Read Access in Oracle Agile Engineering Data Management v6.2.1
Weaknesses CWE-200
CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Engineering Communication Interface). The supported version that is affected is 6.2.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile Engineering Data Management. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Agile Engineering Data Management accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
First Time appeared Oracle
Oracle agile Engineering Data Management
CPEs cpe:2.3:a:oracle:agile_engineering_data_management:6.2.1:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle agile Engineering Data Management
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Oracle Agile Engineering Data Management
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-22T15:18:01.180Z

Reserved: 2026-09-28T15:40:09.503Z

Link: CVE-2026-101745

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:18:29.530

Modified: 2026-10-22T16:17:15.197

Link: CVE-2026-101745

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T17:45:08Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-284

    Improper Access Control