CVE-2026-101738

Status: ReceivedLow (3.1)—

Severity3.1Low · CVSS 3.1

Exploitation probability—next 30 days

Active exploitationNonot in the CISA catalog

Public exploitNot knownno public code found

Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Engineering Communication Interface). The supported version that is affected is 6.2.1. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Engineering Data Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Agile Engineering Data Management accessible data. CVSS 3.1 Base Score 3.1 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N).

CVSS

Base score: 3.1
Version: 3.1
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

Exploitation probability (EPSS)

FIRST hasn't scored this CVE yet (usual for very recent or rejected CVEs).

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

ExploitationT1210 Exploitation of Remote Serviceslateral movement85 %
Primary impactT1565 Data Manipulationimpact85 %

Vector AV:N/PR:L/UI:N: red con privilegios bajos vía HTTP; el texto cita acceso no autorizado para actualizar, insertar o borrar datos (I:L).

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

ATT&CK mitigations that cover these techniques

Network Segmentation Vulnerability Scanning Threat Intelligence Program Restrict File and Directory Permissions Privileged Account Management Remote Data Storage

Affected technologies (1)

⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.

Oracle — Agile Engineering Data Management^AI

References

Show 1 references

https://www.oracle.com/security-alerts/cpuoct2026.html

Raw JSON (NVD)

Show

{
  "id": "CVE-2026-101738",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "secalert_us@oracle.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 3.1,
          "attackVector": "NETWORK",
          "baseSeverity": "LOW",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 1.6
      }
    ]
  },
  "affected": [
    {
      "source": "secalert_us@oracle.com",
      "affectedData": [
        {
          "vendor": "Oracle Corporation",
          "product": "Oracle Agile Engineering Data Management",
          "versions": [
            {
              "status": "affected",
              "version": "6.2.1",
              "versionType": "semver"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-10-20T22:18:28.757",
  "references": [
    {
      "url": "https://www.oracle.com/security-alerts/cpuoct2026.html",
      "source": "secalert_us@oracle.com"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Engineering Communication Interface).   The supported version that is affected is 6.2.1. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Engineering Data Management.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Agile Engineering Data Management accessible data. CVSS 3.1 Base Score 3.1 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N)."
    }
  ],
  "lastModified": "2026-10-20T22:18:28.757",
  "sourceIdentifier": "secalert_us@oracle.com"
}