CVE-2026-61187: Oracle Agile Engineering Data DOS Vulnerability

CVE-2026-61187 Overview

CVE-2026-61187 affects the Install component of Oracle Agile Engineering Data Management, part of the Oracle Supply Chain product family. The supported version confirmed as vulnerable is 6.2.1. A low-privileged attacker with local logon access to the infrastructure where Oracle Agile Engineering Data Management runs can exploit this flaw. Successful exploitation requires human interaction from a user other than the attacker. The vulnerability produces a partial denial of service (DoS) condition affecting the availability of the application.

Critical Impact
Local, low-privileged attackers can trigger a partial denial of service in Oracle Agile Engineering Data Management 6.2.1 when a second user interacts with the affected component.

Affected Products

Oracle Agile Engineering Data Management 6.2.1
Oracle Supply Chain product suite (Install component)
Deployments running on infrastructure permitting interactive local logon

Discovery Timeline

2026-07-21 - CVE-2026-61187 published to the National Vulnerability Database (NVD)
2026-07-21 - Last updated in the NVD database
July 2026 - Addressed in the Oracle Critical Patch Update July 2026

Technical Details for CVE-2026-61187

Vulnerability Analysis

The vulnerability resides in the Install component of Oracle Agile Engineering Data Management 6.2.1. Exploitation requires the attacker to hold valid low-privilege credentials on the host running the application. The attack path is local, meaning remote network exploitation is not possible. The impact is restricted to availability: confidentiality and integrity are not affected. Successful exploitation produces a partial denial of service rather than a full outage. Because exploitation requires interaction from another user, the vulnerability is best classified as a Local Denial of Service issue with a social-engineering dependency.

Root Cause

Oracle has not published detailed root cause information in public advisories. The issue is scoped to the Install component, which suggests improper handling of installer-invoked resources, configuration files, or setup routines that a second user must trigger. The requirement for user interaction indicates the vulnerable code path executes in the context of a user who runs or completes an installation-related action initiated or influenced by the attacker.

Attack Vector

An authenticated local user with limited privileges stages or modifies an artifact tied to the Install component. When a separate user later invokes the affected installation-related functionality, the malicious input triggers the fault, degrading availability of Oracle Agile Engineering Data Management. The Exploit Prediction Scoring System (EPSS) score is 0.124%, reflecting a low likelihood of widespread exploitation. No public proof-of-concept, exploit code, or CISA KEV listing exists for this CVE at publication time.

No verified exploit code is available for this vulnerability. See the Oracle Security Alert July 2026 for vendor-provided technical detail.

Detection Methods for CVE-2026-61187

Indicators of Compromise

Unexpected termination or unresponsiveness of Oracle Agile Engineering Data Management services on hosts running version 6.2.1.
Installation or setup activity initiated by a low-privileged local account followed by service disruption when another user interacts with the application.
Anomalous file or configuration modifications within the Install component directories authored by non-administrative accounts.

Detection Strategies

Monitor process crash and restart events for Oracle Agile Engineering Data Management binaries and services.
Correlate local logon events from low-privileged accounts with subsequent installer or setup executions by other users.
Audit file integrity on Install component directories to identify unauthorized staging of malicious content.

Monitoring Recommendations

Enable OS-level auditing for interactive logons on all hosts running Oracle Agile Engineering Data Management.
Ingest application logs and Windows or Linux audit records into a centralized SIEM for correlation.
Alert on repeated availability failures of the Oracle Agile Engineering Data Management service tied to user session activity.

How to Mitigate CVE-2026-61187

Immediate Actions Required

Apply the fixes shipped in the Oracle Critical Patch Update July 2026 to all Oracle Agile Engineering Data Management 6.2.1 deployments.
Restrict interactive local logon rights on hosts running the application to trusted administrators only.
Review privilege assignments to remove unnecessary low-privilege accounts from production application servers.

Patch Information

Oracle addressed CVE-2026-61187 in the July 2026 Critical Patch Update. Administrators should download the patch bundle for Oracle Agile Engineering Data Management from My Oracle Support and apply it to all instances running version 6.2.1. Validate patch application by confirming the updated component build numbers against Oracle's release documentation.

Workarounds

Limit access to the server hosting Oracle Agile Engineering Data Management to administrators only until the patch is deployed.
Disable non-essential local user accounts on affected hosts to reduce the population of potential low-privileged attackers.
Enforce change control on installer executions so only authorized personnel run setup-related actions.

bash

# Example: restrict interactive logon on a Linux host running Oracle AgileEDM
# Remove interactive shell access for a low-privileged account
sudo usermod -s /usr/sbin/nologin <username>

# Verify current interactive logon sessions
who
last -a | head -n 20