---
id: "CVE-2026-101739"
kind: "vulnerability"
aliases: ["CVE-2026-101739"]
title: "Oracle Agile Engineering Data Management: local low-privilege user can take over"
severity: "high"
cvss: 7.0
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "Oracle Agile Engineering Data Management", "fixed": [], "affected": "6.2.1", "ecosystem": "vendor"}]
ecosystems: []
tags: ["agile-plm", "engineering-data", "local-privilege", "on-prem", "oracle", "supply-chain", "vendor"]
not_affected_if: ["cpuoct2026-applied", "no-local-logon-users", "not-version-6.2.1"]
published_at: "2026-10-20T22:18:28+00:00"
first_seen_at: "2026-10-23T21:57:23+00:00"
updated_at: "2026-10-25T03:39:09+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101739", "first_seen_at": "2026-10-23T21:57:23+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-25T03:39:09+00:00"}]
---

# Oracle Agile Engineering Data Management: local low-privilege user can take over

Oracle Agile Engineering Data Management version 6.2.1 has a flaw in its Engineering Communication Interface component. A low-privileged user who can log on to the host running the product can compromise the whole application.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle Agile Engineering Data Management affected 6.2.1 fixed ?

## How to check

Confirm whether Oracle Agile Engineering Data Management 6.2.1 is installed (only this version is listed as affected). Then list which accounts can log on locally to that host (OS users, SSH, RDP, shared service accounts). Check the October 2026 CPU patch level in My Oracle Support.

## Fix

Apply the October 2026 Critical Patch Update for Oracle Agile Engineering Data Management 6.2.1, using the Oracle Supply Chain Products patch availability document on My Oracle Support. The exact patch or fixed version number is not public: unknown.

## Timeline

- 2026-10-23T21:57:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101739
- 2026-10-25T03:39:09+00:00 analyst — Oracle October 2026 CPU lists Agile EDM 6.2.1 as affected, patch via the Oracle Supply Chain Products patch availability document (My Oracle Support, not public). No fixed version number or workaround published; no exploitation or PoC found.

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [describes] CVE Record: CVE-2026-101739 https://www.cve.org/CVERecord?id=CVE-2026-101739

## From the sources

Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Engineering Communication Interface).   The supported version that is affected is 6.2.1. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Agile Engineering Data Management executes to compromise Oracle Agile Engineering Data Management.  Successful attacks of this vulnerability can result in takeover of Oracle Agile Engineering Data Management. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_