CVE-2026-61195: Oracle Agile Engineering Data DoS Vulnerability

CVE-2026-61195 Overview

CVE-2026-61195 is a denial of service vulnerability in the Core component of Oracle Agile Engineering Data Management, part of the Oracle Supply Chain product family. The affected version is 6.2.1. A low-privileged attacker with network access via TCP can exploit the flaw to cause a hang or a frequently repeatable crash, resulting in complete denial of service of the application. Exploitation does not require user interaction and does not impact confidentiality or integrity. Oracle disclosed the issue in its July 2026 Critical Patch Update.

Critical Impact
Authenticated network attackers can trigger a complete availability outage of Oracle Agile Engineering Data Management, disrupting engineering change and product lifecycle workflows.

Affected Products

Oracle Agile Engineering Data Management 6.2.1
Oracle Supply Chain (Core component)
Deployments exposing the Agile EDM service over TCP

Discovery Timeline

2026-07-21 - CVE-2026-61195 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Addressed in the Oracle Critical Patch Update - July 2026

Technical Details for CVE-2026-61195

Vulnerability Analysis

The vulnerability resides in the Core component of Oracle Agile Engineering Data Management 6.2.1. An authenticated attacker with low privileges can send crafted requests over TCP to the application service. Successful exploitation causes the service to hang or crash repeatedly, producing a complete denial of service condition. Oracle categorizes the impact as availability-only, with no compromise of confidentiality or integrity. The flaw is described as easily exploitable and requires no user interaction, meaning any account with valid low-privilege credentials to the EDM interface can trigger the condition.

Agile Engineering Data Management is used to manage engineering bills of materials, CAD data, and product change orders. An outage disrupts collaboration between engineering and manufacturing teams and can stall release workflows.

Root Cause

Oracle has not publicly disclosed the underlying defect in the Core component. Based on the CVSS availability-only impact and the low complexity of exploitation, the issue is consistent with unhandled input processing or resource exhaustion within a network-facing handler. Refer to the Oracle Security Alert - July 2026 for authoritative technical details as they become available.

Attack Vector

The attack vector is network based over TCP. The attacker must hold a valid low-privileged account on the target Oracle Agile EDM instance. From that position, the attacker submits requests that place the service into a hang state or force a crash. Repeated exploitation prevents legitimate users from accessing engineering data until the service is restarted or patched.

No verified public exploit code is available. The vulnerability mechanism is described in prose because no proof-of-concept has been released.

Detection Methods for CVE-2026-61195

Indicators of Compromise

Unexpected process termination or hang states in the Agile EDM application server logs
Repeated abnormal disconnects or protocol errors on the Agile EDM TCP listener
Spikes in failed engineering data queries followed by service unavailability

Detection Strategies

Monitor Agile EDM server logs for repeated fatal exceptions, thread pool exhaustion, or JVM crashes
Correlate authenticated session activity with immediate service degradation to identify potential abuse
Alert on service restarts of the Agile EDM process outside of planned maintenance windows

Monitoring Recommendations

Track availability metrics and TCP connection health of the Agile EDM endpoint with synthetic checks
Enable audit logging for low-privileged accounts and review activity preceding outages
Forward application, host, and network telemetry to a centralized platform for cross-source correlation

How to Mitigate CVE-2026-61195

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update for Oracle Agile Engineering Data Management 6.2.1
Restrict network access to the Agile EDM TCP service to trusted management networks and identified user segments
Review and reduce the number of low-privileged accounts with access to Agile EDM
Rotate credentials for any accounts suspected of misuse

Patch Information

Oracle addressed CVE-2026-61195 in the July 2026 Critical Patch Update. Administrators should download and apply the fix documented in the Oracle Critical Patch Update Advisory - July 2026. Verify the patch level of each Agile EDM instance after deployment and confirm that the Core component is at the fixed revision.

Workarounds

Limit exposure of the Agile EDM TCP listener to internal networks using firewall or ACL controls
Enforce least-privilege access and remove unused Agile EDM accounts until patching is complete
Configure service watchdogs to automatically restart Agile EDM if it enters a hang or crashed state, reducing outage duration