CVE-2026-61191: Oracle Agile EDM Auth Bypass Vulnerability

CVE-2026-61191 Overview

CVE-2026-61191 affects Oracle Agile Engineering Data Management version 6.2.1, specifically the Document Management component within Oracle Supply Chain. The vulnerability allows a low-privileged attacker with logon access to the underlying infrastructure to compromise the application. Successful exploitation grants unauthorized update, insert, or delete access to a subset of application data and can cause a partial denial of service. Oracle disclosed the issue in the July 2026 Critical Patch Update.

Critical Impact
Authenticated local attackers can tamper with Document Management data and degrade service availability in Oracle Agile Engineering Data Management 6.2.1.

Affected Products

Oracle Agile Engineering Data Management 6.2.1
Oracle Supply Chain — Document Management component
Deployments running on infrastructure exposing local logon to standard users

Discovery Timeline

2026-07-21 - CVE CVE-2026-61191 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Addressed in the Oracle Critical Patch Update July 2026

Technical Details for CVE-2026-61191

Vulnerability Analysis

The flaw resides in the Document Management component of Oracle Agile Engineering Data Management 6.2.1. An attacker requires local logon on the host running the application and only low-level privileges to exploit it. The vulnerability affects integrity and availability but does not expose confidential data. Exploitation yields unauthorized write operations against a subset of application data and enables a partial denial of service against Oracle Agile Engineering Data Management.

Oracle categorizes the issue as easily exploitable, meaning the attack complexity is low and no user interaction is required. The scope remains unchanged, so impact is confined to the vulnerable component. The EPSS score is 0.132%, indicating a low probability of near-term exploitation activity in the wild.

Root Cause

Oracle has not published root-cause details for CVE-2026-61191. Based on the CVSS metrics and the affected component, the weakness aligns with improper access control or authorization checks within Document Management operations. The advisory confirms that an authenticated local user can bypass intended restrictions to modify data and disrupt service. Refer to the Oracle Critical Patch Update July 2026 advisory for vendor-authoritative context.

Attack Vector

The attack requires a local vector. An attacker must first authenticate to the host operating system where Oracle Agile Engineering Data Management runs. From that foothold, the attacker interacts with Document Management interfaces to write to or delete records they should not be able to modify. The same access path can be used to consume resources and trigger a partial denial of service against the application.

No public proof-of-concept exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-61191

Indicators of Compromise

Unexpected create, update, or delete events in Document Management audit logs performed by low-privileged accounts
Interactive or remote logon sessions from non-administrative accounts on Oracle Agile EDM application servers
Service-level errors, thread exhaustion, or process restarts affecting the Oracle Agile EDM application tier

Detection Strategies

Enable Oracle Agile EDM application auditing and forward events to a centralized SIEM for correlation against user role baselines
Alert on privilege-to-action mismatches where low-privileged users perform document modifications outside expected workflows
Baseline normal Document Management API and UI activity per user role and flag statistical outliers

Monitoring Recommendations

Monitor OS-level logon events on hosts running Oracle Agile EDM 6.2.1 and correlate with application activity
Track availability metrics for the Oracle Agile EDM service and alert on partial outages or repeated restarts
Review database change logs for unauthorized modifications to Document Management tables

How to Mitigate CVE-2026-61191

Immediate Actions Required

Apply the Oracle Critical Patch Update July 2026 fixes to all Oracle Agile Engineering Data Management 6.2.1 deployments
Inventory all local accounts with logon rights on Oracle Agile EDM hosts and remove unneeded access
Rotate credentials for any low-privileged accounts that should no longer retain interactive logon

Patch Information

Oracle addressed CVE-2026-61191 in the July 2026 Critical Patch Update. Administrators should review the Oracle Critical Patch Update July 2026 advisory, obtain the applicable patch for Oracle Agile Engineering Data Management 6.2.1, and follow Oracle's documented upgrade procedure in a staged environment before production rollout.

Workarounds

Restrict interactive and remote logon on Oracle Agile EDM servers to a minimal set of administrative accounts until patched
Enforce host-level access controls and jump-server requirements to prevent direct low-privileged access
Increase audit log retention and review frequency for Document Management activity during the patch window