## Summary
CVE-2026-87261 is a vulnerability in Oracle Agile Engineering Data Management (component: Engineering Communication Interface) within Oracle Supply Chain. The affected supported version is 6.2.1, and exploitation is described as easily exploitable by a low-privileged attacker with logon to the infrastructure where the product runs.
Successful exploitation may lead to unauthorized access to critical data and allow unauthorized update/insert/delete access to some accessible data.
## Technical Details
- Product/component: Oracle Agile Engineering Data Management → Engineering Communication Interface
- Affected version: 6.2.1
- Attack vector: LOCAL
- Preconditions (from NVD): attacker has logon to the infrastructure where the product executes
- Privileges required: PR:L (low privileges)
- User interaction: UI:N (no user interaction)
- Impact scope: S:C (changed scope)
- Likely outcomes (from NVD):
- C:H (high confidentiality impact)
- I:L (low integrity impact)
- A:N (no availability impact)
## Affected
- Oracle Agile Engineering Data Management (component: Engineering Communication Interface)
- Version: 6.2.1
## Impact
- Unauthorized access to critical data
- Potential for complete access to all Oracle Agile Engineering Data Management accessible data
- Unauthorized update/insert/delete access to some accessible data
- Scope change to additional products is possible (per NVD: “scope change”)
## Mitigation
1. Apply the vendor’s security update/patch for Engineering Communication Interface in Oracle Agile Engineering Data Management (no specific fixed version was provided in the available content).
2. Restrict and monitor low-privileged access to the infrastructure hosting Oracle Agile Engineering Data Management, since exploitation requires logon.
3. Review access to data paths and interfaces exposed by the Engineering Communication Interface component for signs of unauthorized reads/writes.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N