PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-61189 Oracle CVE debrief

A medium-severity vulnerability was found in Oracle Agile Engineering Data Management, a product within Oracle Supply Chain. The issue, tracked as CVE-2026-61189, has a CVSS score of 6.5 and allows low-privileged attackers with logon access to compromise the system, potentially impacting additional products. The vulnerability is in the Install component of version 6.2.1. Successful attacks can result in unauthorized access to critical data or complete access to all Oracle Agile Engineering Data Management accessible data.

Vendor
Oracle
Product
Agile Engineering Data Management
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-21
Original CVE updated
2026-07-28
Advisory published
2026-07-21
Advisory updated
2026-07-28

Who should care

Security teams and administrators responsible for Oracle Agile Engineering Data Management should be aware of this vulnerability and take necessary actions to mitigate the risk. This includes reviewing system deployments, assessing potential impacts, and implementing compensating controls if necessary. Operators, platform administrators, and vulnerability management teams should also review the vulnerability and its potential effects on their environments.

Technical summary

CVE-2026-61189 is a vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Install). The supported version that is affected is 6.2.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Agile Engineering Data Management executes to compromise Oracle Agile Engineering Data Management. While the vulnerability is in Oracle Agile Engineering Data Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Agile Engineering Data Management accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).

Defensive priority

Apply patches or mitigations provided by Oracle to prevent exploitation. Restrict access to the affected system and monitor for suspicious activity.

Recommended defensive actions

  • Apply patches or mitigations provided by Oracle
  • Restrict access to the affected system
  • Monitor for suspicious activity
  • Implement compensating controls
  • Conduct regular vulnerability assessments
  • Review system deployments and assign an owner for follow-up
  • Track exceptions and retest remediated assets

Evidence notes

The CVE record was published on 2026-07-21T22:18:50.830Z and was last modified on 2026-07-28T02:11:14.503Z. The NVD entry is currently Analyzed. Oracle Agile Engineering Data Management is a product within Oracle Supply Chain that may be affected by this vulnerability. The vulnerability is in the Install component. Defenders should verify the affected version 6.2.1 and assess potential scope changes.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-21T22:18:50.830Z and has not been modified since then. The NVD entry is currently Analyzed.