{"id":"CVE-2026-101739","kind":"vulnerability","aliases":["CVE-2026-101739"],"related":[],"title":"Oracle Agile Engineering Data Management: local low-privilege user can take over","description":"Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Engineering Communication Interface).   The supported version that is affected is 6.2.1. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Agile Engineering Data Management executes to compromise Oracle Agile Engineering Data Management.  Successful attacks of this vulnerability can result in takeover of Oracle Agile Engineering Data Management. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle Agile Engineering Data Management version 6.2.1 has a flaw in its Engineering Communication Interface component. A low-privileged user who can log on to the host running the product can compromise the whole application.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle Agile Engineering Data Management","fixed":[],"affected":"6.2.1","ecosystem":"vendor"}],"ecosystems":[],"tags":["agile-plm","engineering-data","local-privilege","on-prem","oracle","supply-chain","vendor"],"not_affected_if":["cpuoct2026-applied","no-local-logon-users","not-version-6.2.1"],"how_to_check":"Confirm whether Oracle Agile Engineering Data Management 6.2.1 is installed (only this version is listed as affected). Then list which accounts can log on locally to that host (OS users, SSH, RDP, shared service accounts). Check the October 2026 CPU patch level in My Oracle Support.","fix":"Apply the October 2026 Critical Patch Update for Oracle Agile Engineering Data Management 6.2.1, using the Oracle Supply Chain Products patch availability document on My Oracle Support. The exact patch or fixed version number is not public: unknown.","status":"open","published_at":"2026-10-20T22:18:28+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","triaged_at":"2026-10-25T03:38:12+00:00","updated_at":"2026-10-25T03:39:09+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-25T03:38:12Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Oracle Agile Engineering Data Management: local low-privilege user can take over","impact":"high","summary":"Oracle Agile Engineering Data Management version 6.2.1 has a flaw in its Engineering Communication Interface component. A low-privileged user who can log on to the host running the product can compromise the whole application.","category":"vendor","nicknames":[],"who_cares":["oracle","agile-plm","on-prem","engineering-data"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker takes over the application and affects confidentiality, integrity and availability","analyst_note":"Find the Oracle Security Alert or patch advisory for CVE-2026-101739 to confirm the fixed version and any workaround.","how_to_check":"- Confirm whether `Oracle Agile Engineering Data Management` version `6.2.1` is deployed\n- Check which accounts have logon access to the host running the product","needs_analyst":true,"not_affected_if":["not-version-6.2.1","no-local-logon-users"],"who_is_affected":"Teams running Oracle Agile Engineering Data Management 6.2.1 on a server where other people or services hold local logon accounts. The attack needs local logon to the infrastructure, so an internet-only exposure is not the risk described. Sites with no such product version, or with only trusted local accounts, face less exposure.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000608,"input_tokens":3488,"output_tokens":519,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Oracle Security Alert or patch advisory for CVE-2026-101739 to confirm the fixed version and any workaround.","search":"'-101739':15A,18A '-2026':14A,17A '/av':158C '3.1':145C,157C '6.2.1':47B,101C '7.0':148C 'affect':99C 'agil':2A,25B,42B,81C,117C,125C,140C 'agile':20A 'agile-plm':24B 'allow':106C 'applic':76B 'attack':109C,130C 'avail':152C 'base':146C 'chain':39B,89C 'communic':54B,92C 'compon':56B,90C 'compromis':73B,123C 'confidenti':149C 'cve':13A,16A 'cvss':144C,154C,156C 'data':4A,22A,29B,44B,83C,119C,127C,142C 'difficult':102C 'engin':3A,28B,43B,53B,82C,91C,118C,126C,141C 'engineering':21A 'engineering-data':27B 'execut':121C 'exploit':104C 'flaw':50B 'h':166C 'h/a':165C 'h/i':164C 'h/pr':160C 'host':68B 'impact':153C 'infrastructur':114C 'integr':150C 'interfac':55B,93C 'l/ac':159C 'l/ui':161C 'local':6A,31B 'local-privileg':30B 'log':64B 'logon':111C 'low':8A,59B,107C 'low-privileg':7A,58B 'manag':5A,45B,84C,120C,128C,143C 'management':23A 'n/s':162C 'on-prem':33B 'oracl':1A,36B,41B,80C,87C,116C,124C,139C 'oracle':19A 'plm':26B 'prem':35B 'privileg':9A,32B,60B,108C 'product':71B,85C 'result':135C 'run':69B 'score':147C 'success':129C 'suppli':38B,88C 'supply-chain':37B 'support':95C 'take':12A 'takeov':137C 'u/c':163C 'user':10A,61B 'vector':155C 'vendor':40B 'version':46B,96C 'vulner':77C,105C,133C 'whole':75B","nicknames":[],"mitigations":[],"who_affected":"Teams running Oracle Agile Engineering Data Management 6.2.1 on a server where other people or services hold local logon accounts. The attack needs local logon to the infrastructure, so an internet-only exposure is not the risk described. Sites with no such product version, or with only trusted local accounts, face less exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:28+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101739","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101739","severity":null,"published_at":"2026-10-20T22:18:28+00:00","modified_at":"2026-10-22T16:17:14+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","fetched_at":"2026-10-23T22:28:59+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-101739:761","url":null,"severity":null,"published_at":"2026-10-25T03:39:09+00:00","modified_at":"2026-10-25T03:39:09+00:00","first_seen_at":"2026-10-25T03:39:09+00:00","fetched_at":"2026-10-25T03:39:09+00:00","note":"Oracle October 2026 CPU lists Agile EDM 6.2.1 as affected, patch via the Oracle Supply Chain Products patch availability document (My Oracle Support, not public). No fixed version number or workaround published; no exploitation or PoC found."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3266,"url":"https://www.cve.org/CVERecord?id=CVE-2026-101739","title":"CVE Record: CVE-2026-101739","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}