PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-61190 Oracle CVE debrief

A medium-severity vulnerability was found in Oracle Agile Engineering Data Management, specifically in the Install component. This vulnerability, tracked as CVE-2026-61190, has a CVSS score of 6.4 and can allow a low-privileged attacker with network access via HTTP to compromise the system. Successful attacks require human interaction and can lead to unauthorized creation, deletion, or modification of critical data. The vulnerability is difficult to exploit and requires human interaction from a person other than the attacker.

Vendor
Oracle
Product
Agile Engineering Data Management
CVSS
MEDIUM 6.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-21
Original CVE updated
2026-07-28
Advisory published
2026-07-21
Advisory updated
2026-07-28

Who should care

System administrators and security teams responsible for Oracle Agile Engineering Data Management should be aware of this vulnerability and take necessary actions to mitigate the risk. They should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. They should also plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Technical summary

The vulnerability is located in the Install component of Oracle Agile Engineering Data Management version 6.2.1. It is a difficult-to-exploit vulnerability that requires human interaction from a person other than the attacker. A low-privileged attacker with network access via HTTP can compromise the system, leading to unauthorized access to critical data or complete access to all Oracle Agile Engineering Data Management accessible data. The CVSS vector is (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N).

Defensive priority

Medium priority should be given to patching this vulnerability, as it can lead to significant data breaches if exploited.

Recommended defensive actions

  • Apply the patch provided by Oracle as soon as possible.
  • Restrict network access to the Oracle Agile Engineering Data Management system.
  • Monitor system logs for suspicious activity.
  • Implement additional security measures, such as multi-factor authentication.
  • Review compensating controls for exposed systems while remediation is scheduled and verified.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record was published on 2026-07-21T22:18:50.943Z and last modified on 2026-07-28T02:11:09.130Z. The NVD entry is currently Analyzed. This vulnerability affects Oracle Agile Engineering Data Management version 6.2.1, specifically the Install component. The CVSS score is 6.4, indicating a medium-severity vulnerability. The vulnerability allows a low-privileged attacker with network access via HTTP to compromise the system, potentially leading to unauthorized creation, deletion, or modification of critical data.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-21T22:18:50.943Z and has not been modified since then. The NVD entry is currently Analyzed.