CVE-2026-87261

Executive Summary

CVE-2026-87261 is a high-severity vulnerability (CVSS 7.3) in Oracle Agile Engineering Data Management, specifically within the Engineering Communication Interface component of Oracle Supply Chain. The flaw affects version 6.2.1 and allows a low-privileged attacker with local logon access to compromise the application, leading to unauthorized access to critical data and limited data modification. No public exploit, PoC, or patch currently exists, and the EPSS score has not been assigned by FIRST.org.

Technical Analysis

The vulnerability resides in Oracle Agile Engineering Data Management version 6.2.1, specifically in the Engineering Communication Interface component. According to the NVD description, the vulnerability is "easily exploitable" and requires the attacker to have low privileges and logon access to the infrastructure where the application executes. The CVSS vector indicates local attack vector (AV:L), low attack complexity (AC:L), low privileges required (PR:L), no user interaction (UI:N), and a scope change (S:C). The scope change implies that while the vulnerability exists in Oracle Agile Engineering Data Management, successful exploitation can significantly impact additional products beyond the vulnerable component.

The flaw class is consistent with improper access control or authorization bypass (CWE-284), given the stated impacts: high confidentiality impact (C:H) allowing unauthorized access to critical data or complete access to all Oracle Agile Engineering Data Management accessible data, and low integrity impact (I:L) permitting unauthorized update, insert, or delete access to some accessible data. The lack of specific technical details in the description prevents identification of exact functions, parameters, or code paths. No CWE is assigned, but the combined impact pattern and the "low privileged attacker with logon" requirement strongly suggest a privilege escalation or access control weakness within the Engineering Communication Interface.

The Engineering Communication Interface is likely responsible for facilitating data exchange between Agile EDM and other systems or components. Because the vulnerability allows scope change, an attacker may pivot from the Agile EDM application to impact connected products or services. The local attack vector means the attacker must already have some level of access to the host system, but the low privilege requirement indicates that even a basic user account can trigger the flaw.

No exploit code, Nuclei template, or PoC is available in public sources. The patch confidence is 0/4, meaning no vendor fix or workaround has been identified through tracked sources. This leaves affected organizations with no direct remediation from Oracle at this time.

Exploitation Scenarios

Based strictly on the provided NVD description, the attack chain for CVE-2026-87261 can be described at the vulnerability-class level:

1. Reconnaissance and Target Identification: An attacker gains low-privileged logon access to the infrastructure hosting Oracle Agile Engineering Data Management 6.2.1. This could be achieved through compromised credentials, insider access, or lateral movement from another system. The attacker identifies that the Engineering Communication Interface component is reachable and that the application version is 6.2.1.

2. Triggering the Flaw: The vulnerability is in the Engineering Communication Interface. Because the exact vulnerable function or parameter is not disclosed in the NVD description, the attacker would need to probe the interface for improper access control. The flaw class (improper access control) suggests that the attacker can bypass authorization checks by manipulating requests to the interface, potentially by accessing resources or operations that should require higher privileges. The low attack complexity and no user interaction required mean that the attacker can exploit the flaw directly without tricking a user.

3. Payload/Execution Method: No specific payload details are available. At the vulnerability-class level, the attacker would send crafted requests to the Engineering Communication Interface that exploit missing or inadequate authorization checks. This could involve accessing data or performing operations that are normally restricted to higher-privileged users. Because the scope is changed, the attacker might also be able to leverage the compromised Agile EDM instance to affect other products, though the exact mechanism is unspecified.

4. Post-Exploitation Impact: Successful exploitation results in unauthorized access to critical data or complete access to all Oracle Agile Engineering Data Management accessible data (high confidentiality impact). The attacker can also perform unauthorized update, insert, or delete operations on some accessible data (low integrity impact). The scope change means that additional products may be significantly impacted, potentially allowing further compromise or data leakage across connected systems. No public PoC is available; the attack chain is inferred from the vulnerability class and CVSS metrics.

Impact Assessment

The business impact of CVE-2026-87261 is significant due to the high confidentiality impact and the potential for scope change. Organizations using Oracle Agile Engineering Data Management 6.2.1 are at risk. The vulnerability allows a low-privileged attacker with local logon access to read all accessible data, which may include sensitive engineering data, product designs, intellectual property, and supply chain information. The integrity impact is limited but still allows unauthorized modification of some data, which could lead to data corruption or manipulation of engineering records.

The CVSS score of 7.3 is derived from the vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N. The scope change (S:C) indicates that a successful exploit can affect resources beyond the vulnerable component, potentially impacting other products in the Oracle Supply Chain suite or integrated systems. The blast radius includes not only the Agile EDM instance but also any connected applications or services that rely on the Engineering Communication Interface. No availability impact (A:N) is reported, so denial of service is not a primary concern.

Because no patch is available (patch confidence 0/4), the vulnerability remains unmitigated for all affected deployments. The lack of public exploit code or EPSS score does not reduce the risk, as the vulnerability is described as "easily exploitable" and could be weaponized by attackers with local access.

Detection Guidance

Sigma Rule

title: Potential Oracle Agile EDM Engineering Communication Interface Access Control Bypass
id: 8f3a2b1c-4d5e-6f7a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects potential exploitation attempts against CVE-2026-87261 in Oracle Agile Engineering Data Management 6.2.1 via abnormal access to the Engineering Communication Interface.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-87261
author: Threat Intelligence Team
date: 2026-05-20
tags:
  - attack.t1190
  - cve.2026.87261
logsource:
  category: webserver
  product: oracle
  service: agile_edm
detection:
  selection:
    cs-method:
      - 'POST'
      - 'GET'
    cs-uri-stem|contains:
      - '/EngineeringCommunicationInterface'
      - '/eci'
    sc-status:
      - 200
      - 500
  condition: selection
falsepositives:
  - Legitimate administrative activity
level: high

YARA Rule

rule CVE_2026_87261_Oracle_Agile_EDM_Exploit
{
    meta:
        description = "Detects potential exploitation of CVE-2026-87261 in Oracle Agile Engineering Data Management 6.2.1"
        author = "Threat Intelligence Team"
        date = "2026-05-20"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-87261"
        hash = "unknown"
    strings:
        $s1 = "EngineeringCommunicationInterface" ascii wide nocase
        $s2 = "Agile Engineering Data Management" ascii wide nocase
        $s3 = "6.2.1" ascii wide
        $s4 = "Engineering Communication Interface" ascii wide nocase
    condition:
        any of them
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-87261 Oracle Agile EDM Engineering Communication Interface Access Control Bypass Attempt"; flow:to_server,established; content:"/EngineeringCommunicationInterface"; http_uri; nocase; content:"POST"; http_method; reference:cve,2026-87261; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-87261; classtype:attempted-user; sid:10000001; rev:1;)

Elastic Detection

network where process.name == "java" and network.protocol == "http" and
  http.request.method in ("POST", "GET") and
  stringContains(http.request.uri, "/EngineeringCommunicationInterface") and
  http.response.status_code in (200, 500)

Splunk SPL Query

index=web sourcetype=access_combined
| search uri="*EngineeringCommunicationInterface*" OR uri="*/eci*"
| stats count by src_ip, uri, status, method
| where status=200 OR status=500
| sort - count

Wazuh OSSEC Rule

<group name="oracle,agile_edm,">
  <rule id="100200" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <field name="url">/EngineeringCommunicationInterface</field>
    <field name="status">200|500</field>
    <description>CVE-2026-87261: Possible exploitation of Oracle Agile EDM Engineering Communication Interface access control bypass</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_87261,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate Mitigations:

   • Restrict local logon access to the infrastructure hosting Oracle Agile Engineering Data Management 6.2.1 to only trusted, essential personnel.
   • Implement strict network segmentation to limit lateral movement and prevent low-privileged users from reaching the Engineering Communication Interface.
   • Monitor access logs for abnormal requests to the Engineering Communication Interface, particularly from low-privileged accounts.
   • Apply the principle of least privilege to all accounts with logon access.
   • If feasible, temporarily disable or restrict the Engineering Communication Interface if it is not actively used, until a patch is available.

2. Patch/Upgrade Steps:

   • No patch is currently available from Oracle. Continuously monitor Oracle's Critical Patch Update (CPU) and Security Alerts for a fix.
   • Once a patch is released, test it in a staging environment and deploy promptly.
   • Consider upgrading to a later version of Oracle Agile Engineering Data Management if a fixed version becomes available.

3. Long-Term Hardening:

   • Conduct regular security assessments and penetration testing of the Engineering Communication Interface.
   • Implement role-based access control (RBAC) and ensure that all authorization checks are enforced server-side.
   • Enable detailed logging and monitoring for all interactions with the Engineering Communication Interface.
   • Participate in Oracle's security notification services to receive timely alerts.
   • Review and update incident response plans to include this vulnerability class.

References

• NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-87261
• Oracle Critical Patch Updates: https://www.oracle.com/security-alerts/
• CWE-284: Improper Access Control: https://cwe.mitre.org/data/definitions/284.html
• MITRE ATT&CK T1190: Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• FIRST EPSS: Not yet scored (verified as of report date)

No known threat actor campaigns or exploit-in-the-wild evidence have been reported for this CVE. No public PoC or exploit code is available.