CVE-2026-87259

CVE-2026-87259 is a high-severity (CVSS 8.4) flaw in the Engineering Communication Interface component of Oracle Agile Engineering Data Management, part of Oracle Supply Chain, affecting version 6.2.1. It is exploited by a low-privileged attacker who already has a logon on the host or infrastructure where the product executes, making it a local privilege-escalation-style weakness rather than a remotely reachable flaw. Because of a scope change, a successful attack can compromise not only Agile EDM but also significantly impact additional products on the same infrastructure. The attacker gains unauthorized ability to create, delete, or modify critical data, as well as full read access to all data accessible through the product; availability is not affected. The vulnerability is not in the CISA KEV catalog, no public proof of concept is known, and there is no evidence of in-the-wild exploitation.

What to do: Apply the Oracle Critical Patch Update that remediates this issue as soon as Oracle releases it, and check the Oracle advisory for the fixed build of Agile EDM 6.2.1. In the meantime, restrict and audit local OS accounts with logon access to servers hosting Agile EDM, enforce least privilege on those hosts, and monitor for unauthorized creation, deletion, or modification of engineering data via the Engineering Communication Interface.