Description

Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Web Services Security). The supported version that is affected is 6.2.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile Engineering Data Management. Successful attacks of this vulnerability can result in takeover of Oracle Agile Engineering Data Management. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-18T21:18:05.173Z",
  "pubdate": "2026-08-18T21:18:05.173Z",
  "executiveSummary": "A critical security vulnerability affects the Oracle Agile Engineering Data Management product of Oracle Supply Chain, specifically within the Web Services Security component. The vulnerability impacts version 6.2.1 and allows an unauthenticated remote attacker with network access via HTTP to fully compromise the target system. Successful exploitation of this flaw can result in a complete system takeover, yielding high impacts across confidentiality, integrity, and availability. With a CVSS 3.1 Base Score of 8.1, the risk implications are severe, granting malicious actors total administrative control over the affected application. Although the exploitation difficulty is rated as high due to specific preconditions or complexity required to execute the attack successfully, the lack of authentication and reliance on network-based HTTP vectors present a significant exposure risk. Organizations utilizing the affected version must prioritize remediation efforts to prevent unauthorized remote compromise and potential cascading failures within their supply chain data management infrastructure.",
  "technicalDetails": "The vulnerability resides within the Web Services Security component of the Oracle Agile Engineering Data Management product, specifically affecting version 6.2.1. The root cause stems from insecure handling or processing of requests within the web services layer, allowing an unauthenticated adversary to interact with vulnerable functions exposed over the network via the HTTP protocol. Because the attack vector is network-based (AV:N), adversaries do not require prior access to the internal network perimeter, enabling remote exploitation from the public internet or adjacent network segments depending on deployment architecture.\nExploitation does not require user interaction (UI:N) or any pre-existing privileges (PR:N), meaning any external entity capable of establishing an HTTP connection to the vulnerable service can initiate the attack sequence. The attack flow begins when the adversary crafts a specialized payload designed to exploit deficiencies in the Web Services Security implementation. By transmitting this malicious payload over HTTP to the vulnerable endpoint, the attacker bypasses intended authentication and authorization controls enforced by the application layer.\nDespite the attack complexity being rated as high (AC:H), successful execution of the payload allows the attacker to achieve complete control over the affected system. The post-exploitation impact includes full system takeover, manifesting as unauthorized access to sensitive engineering data, the ability to modify or corrupt critical supply chain records, and the potential to disrupt core availability services. The scope remains unchanged (S:U), meaning the impact is contained within the vulnerable Oracle Agile Engineering Data Management instance, yet the triad of confidentiality, integrity, and availability (C:H/I:H/A:H) is entirely compromised upon successful payload execution."
}