{"id":"CVE-2026-101741","kind":"vulnerability","aliases":["CVE-2026-101741"],"related":[],"title":"Oracle Agile Engineering Data Management: unauthenticated attacker reads critical data over segment","description":"Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Engineering Communication Interface).   The supported version that is affected is 6.2.1. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle Agile Engineering Data Management executes to compromise Oracle Agile Engineering Data Management.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Agile Engineering Data Management accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).","summary":"Oracle Agile Engineering Data Management version 6.2.1 has a flaw in its Engineering Communication Interface component. An unauthenticated attacker on the physical communication segment attached to the hardware can gain unauthorized access to critical data.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["engineering-data-management","on-prem","oracle-agile","vendor"],"not_affected_if":["no-physical-segment-access"],"how_to_check":"- Check whether Oracle Agile Engineering Data Management is deployed at version `6.2.1`\n- unknown","fix":"- Apply the Oracle Critical Patch Update fix for Oracle Agile Engineering Data Management, moving off `6.2.1`\n- unknown","status":"open","published_at":"2026-10-20T22:18:29+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","triaged_at":"2026-10-25T04:23:09+00:00","updated_at":"2026-10-25T04:23:09+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T04:23:09Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update fix for Oracle Agile Engineering Data Management, moving off `6.2.1`\n- unknown","reach":"local","title":"Oracle Agile Engineering Data Management: unauthenticated attacker reads critical data over segment","impact":"medium","summary":"Oracle Agile Engineering Data Management version 6.2.1 has a flaw in its Engineering Communication Interface component. An unauthenticated attacker on the physical communication segment attached to the hardware can gain unauthorized access to critical data.","category":"vendor","nicknames":[],"who_cares":["oracle-agile","engineering-data-management","on-prem"],"confidence":0.6,"needs_auth":"no","worst_case":"unauthorized read of critical data from the product","analyst_note":"Confirm the fixed Oracle CPU release and the exact affected deployment configuration at the NVD or Oracle advisory page.","how_to_check":"- Check whether Oracle Agile Engineering Data Management is deployed at version `6.2.1`\n- unknown","needs_analyst":true,"not_affected_if":["no-physical-segment-access"],"who_is_affected":"Only installations of Oracle Agile Engineering Data Management 6.2.1 are named in the sources. The attacker must be on the physical communication segment attached to the hardware running the product, so exposure depends on network segmentation. Teams without this product, or without that network access path, can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000621,"input_tokens":3507,"output_tokens":541,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-101741':15A,18A '-2026':14A,17A '/av':159C '3.1':149C,158C '5.3':152C '6.2.1':36B,89C 'a/ac':160C 'access':61B,98C,132C,138C,146C 'affect':87C 'agil':2A,28B,31B,69C,111C,119C,142C 'allow':94C 'attach':54B,104C 'attack':7A,48B,96C,124C 'base':150C 'chain':77C 'communic':43B,52B,80C,102C 'complet':137C 'compon':45B,78C 'compromis':117C 'confidenti':153C 'critic':9A,63B,134C 'cve':13A,16A 'cvss':148C,155C,157C 'data':4A,10A,21B,33B,64B,71C,113C,121C,135C,144C,147C 'difficult':90C 'engin':3A,20B,32B,42B,70C,79C,112C,120C,143C 'engineering-data-manag':19B 'execut':115C 'exploit':92C 'flaw':39B 'gain':59B 'h/i':165C 'h/pr':161C 'hardwar':57B,107C 'impact':154C 'interfac':44B,81C 'manag':5A,22B,34B,72C,114C,122C,145C 'n':167C 'n/a':166C 'n/s':163C 'n/ui':162C 'on-prem':23B 'oracl':1A,27B,30B,68C,75C,110C,118C,141C 'oracle-agil':26B 'physic':51B,101C 'prem':25B 'product':73C 'read':8A 'result':129C 'score':151C 'segment':12A,53B,103C 'success':123C 'suppli':76C 'support':83C 'u/c':164C 'unauthent':6A,47B,95C 'unauthor':60B,131C 'vector':156C 'vendor':29B 'version':35B,84C 'vulner':65C,93C,127C","nicknames":[],"mitigations":[],"who_affected":"Only installations of Oracle Agile Engineering Data Management 6.2.1 are named in the sources. The attacker must be on the physical communication segment attached to the hardware running the product, so exposure depends on network segmentation. Teams without this product, or without that network access path, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:29+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101741","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101741","severity":null,"published_at":"2026-10-20T22:18:29+00:00","modified_at":"2026-10-22T18:17:18+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","fetched_at":"2026-10-23T22:28:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}