How do I check whether I am affected by CVE-2026-101744?

- Confirm the installed version of Oracle Agile Engineering Data Management and check whether it is `6.2.1`. - unknown

What is the fix for CVE-2026-101744?

- Apply the Oracle Critical Patch Update fix for Oracle Agile Engineering Data Management referenced in the advisory; the exact patched version is unknown from the sources.

Who is not affected by CVE-2026-101744?

Not affected if: component-disabled, not-6.2.1.

Live › vulnerability › CVE-2026-101744

Go to dashboard

high8.4Other

Oracle Agile Engineering Data Management: HTTP flaw lets low-privilege users change critical data

Oracle Agile Engineering Data Management version 6.2.1 has a flaw in its Engineering Communication Interface component. A low-privileged user with network access over HTTP can create, modify, delete or read critical data and cause partial denial of service.

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

8.4

high

scored by [email protected]

known so far3 of 6

missing: versions, primary source, exploitation

First public: Oct 20, 2026 UTC
Last modified: Oct 22, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Yes.
Needs a special setup: Not known from the sources.
Reachable from: network.
Worst case: Attacker reads, changes or deletes all application data; partial outage.
CVSS said: 8.4. The facts above say medium; we keep the sources' high until an analyst looks.

Who is affected

Organizations running Oracle Agile Engineering Data Management 6.2.1 with the Engineering Communication Interface component reachable over HTTP. The sources do not say whether the component is enabled by default. Teams not running this Oracle product can skip it.

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2026-101744

Go to dashboard

high8.4Other

Oracle Agile Engineering Data Management: HTTP flaw lets low-privilege users change critical data

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

8.4

high

scored by [email protected]

known so far3 of 6

missing: versions, primary source, exploitation

First public: Oct 20, 2026 UTC
Last modified: Oct 22, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Yes.
Needs a special setup: Not known from the sources.
Reachable from: network.
Worst case: Attacker reads, changes or deletes all application data; partial outage.
CVSS said: 8.4. The facts above say medium; we keep the sources' high until an analyst looks.

Who is affected

Know the next one before it finds you.

Add to Slack

Oracle Agile Engineering Data Management: HTTP flaw lets low-privilege users change critical data

Why it is high, and not just CVSS

Who is affected

Know the next one before it finds you.

Oracle Agile Engineering Data Management: HTTP flaw lets low-privilege users change critical data

Why it is high, and not just CVSS

Who is affected

Know the next one before it finds you.

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources