CVE-2026-87262: High severity Oracle Oracle Agile Engineering Data Management vulnerability
Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Engineering Communication Interface). The supported version that is affected is 6.2.1. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle Agile Engineering Data Management executes to compromise Oracle Agile Engineering Data Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Agile Engineering Data Management accessible data as well as unauthorized update, insert or delete access to some of Oracle Agile Engineering Data Management accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Oracle Agile Engineering Data Management (Engineering Communication Interface)to a version that resolves this vulnerability.Fixed in 6.2.1 - Compensating control
Restrict access to the physical communication segment attached to the hardware where Oracle Agile Engineering Data Management executes, since unauthenticated attackers with access to that segment can exploit the Engineering Communication Interface vulnerability.
Event History
Frequently Asked Questions
Who is realistically exposed to exploitation?
Systems running Oracle Agile Engineering Data Management version 6.2.1 are exposed when an attacker can access the physical communication segment connected to the hardware hosting the product. The attack does not require authentication or user interaction.
What level of access can an attacker gain?
A successful attack can expose critical data or all data accessible to Oracle Agile Engineering Data Management. It can also allow unauthorized updates, inserts, or deletions of some accessible data.
What should be prioritized if remediation cannot happen immediately?
Restrict access to the physical communication segment attached to the affected host, since network-adjacent physical segment access is the stated attack prerequisite. Limit who can connect to or access that segment and monitor it for unauthorized activity.