Oracle August 2026 CSPU: Nine Vulnerabilities in Agile Engineering Data Management 6.2.1, Including Unauthenticated Web Services Security Flaws (CVE-2026-71052, CVE-2026-71053) — Threadlinqs Intelligence
As of 2026-08-18, Oracle August 2026 CSPU: Nine Vulnerabilities in Agile Engineering Data Management 6.2.1, Including Unauthenticated Web Services Security Flaws (CVE-2026-71052, CVE-2026-71053) is a critical-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 9 indicators of compromise.
Threat ID: TL-2026-2064 · Severity: CRITICAL · CVSS: 8.8 · Status: ACTIVE · Category: VULNERABILITY
Oracle's August 18, 2026 Critical Security Patch Update (CSPU) for Oracle Supply Chain patches nine newly disclosed vulnerabilities in Oracle Agile Engineering Data Management 6.2.1. The most severe,
Oracle Agile Engineering Data Management (Agile EDM) is the engineering/PLM data-management module of Oracle's legacy on-premises Agile PLM suite, used by product-centric organizations in manufacturing, aerospace and defense, automotive, industrial equipment, high-technology, life-sciences, and consumer-goods sectors to manage bills of materials, engineering change orders, and product records. Per Oracle's own Agile EDM Security Guide (edmsc.pdf), the product runs as a WebLogic/J2EE application, exposes its Engineering Communication Interface (ECI) as a web-service endpoint, and authenticates users via LDAP, Kerberos-based Java-client SSO, or WebLogic SAML SSO, typically fronted by an Apache HTTPD SSL reverse proxy — the 'Web Services Security' component patched in this CSPU is the layer responsible for enforcing those authentication/authorization boundaries on ECI's HTTP/SOAP surface. On 2026-08-18 Oracle's August Critical Security Patch Update (CSPU, cspuaug2026.html) for the Oracle Supply Chain product family patched nine new CVEs against Agile EDM version 6.2.1, all published to NVD the same day and all referencing the CSPU advisory; NVD has not yet published CWE assignments for any of the nine as of this research pass (re-verified directly against each of the nine individual NVD JSON API 2.0 records this pass — a typical lag for freshly disclosed vendor-sourced CVEs, and consistent with the vendor advisory page itself, plus its verbose risk-matrix variant, both still returning HTTP 403 to unauthenticated automated fetch).
The two highest-severity flaws are both in the Web Services Security component: CVE-2026-71052 (CVSS 3.1 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) lets a low-privileged, network-based attacker reach full compromise via an 'easily exploitable' HTTP-reachable flaw, and CVE-2026-71053 (CVSS 3.1 8.1, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) is a 'difficult to exploit' unauthenticated variant of the same weakness — together matching the AusCERT/hunt-stage description of 'an unauthenticated attacker... via HTTP' plus 'a separate... flaw allowing a low-privileged network attacker to potentially take over the product.' A second cluster of five CVEs affects the Engineering Communication Interface component with materially different attack profiles confirmed against NVD: CVE-2026-70703 (CVSS 8.2, AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N — scope-changed, network-exploitable, unauthorized create/delete/modify of critical data); CVE-2026-70709 (CVSS 4.8, AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N — unauthenticated network attacker gets unauthorized read access to a subset of data plus unauthorized update/insert/delete on accessible data — Oracle's own NVD-sourced description explicitly names both the read and the write/delete access, the strongest textual evidence in this batch for a data-manipulation impact); CVE-2026-70697 (CVSS 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H — local low-privileged attacker, difficult to exploit, full takeover); CVE-2026-70693 (CVSS 6.3, AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H — local high-privileged attacker AND user interaction from a separate party required); and CVE-2026-70691 (CVSS 7.5, AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H — unauthenticated attacker with physical/adjacent-network access to the communication segment, full takeover). Two remaining CVEs affect the Install component and require existing high-privilege local logon to the infrastructure: CVE-2026-70698 (CVSS 6.7, AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, easily exploitable) and CVE-2026-70712 (CVSS 6.4, AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H, difficult to exploit) — both describe an already-privileged local user abusing a flaw in the Install component's execution path to escalate beyond their granted scope to complete product takeover, rather than gaining privilege from an unprivileged baseline.
Agile EDM 6.2.1 has a recurring pattern of critical, unauthenticated, network-reachable flaws in this same Web Services Security component, and this researc
Target sectors: manufacturing, aerospace-defense, automotive, industrial-equipment, high-technology, life-sciences, consumer-goods
Target regions: Global, australia
Timeline
- Oracle patches CVE-2024-21287 (CVSS 7.5), an unauthenticated information-disclosure flaw in the discontinued Oracle Agile PLM 9.3.6 that was under active in-the-wild exploitation prior to patching, discovered and reported by CrowdStrike researchers Joel Snape and Lutz Wolf; per Oracle's VP of security assurance, an unauthenticated attacker could download files with the privileges of the PLM application. A different, now-discontinued product version from the current Agile EDM 6.2.1, but real-world precedent for unauthenticated HTTP data-access exploitation in the Oracle Agile product family.
- Oracle's January 2026 CPU discloses CVE-2026-21969 (CVSS 9.8), an unauthenticated RCE-class flaw in the Supplier Portal component of the sibling product Oracle Agile Product Lifecycle Management for Process v6.2.4 — establishing a pattern of critical unauthenticated flaws across the Oracle Agile PLM product family.
- Oracle's July 2026 CPU (cpujul2026.html) discloses CVE-2026-61186 (CVSS 9.4, CWE-284/306/400/732), a prior unauthenticated, network-exploitable Web Services Security flaw in the same product and version — Oracle Agile Engineering Data Management 6.2.1 — one month before this CSPU, granting unauthorized data create/delete/modify and causing denial-of-service.
- The same July 2026 CPU also discloses CVE-2026-61187 (CVSS 2.8, CWE-404 Improper Resource Shutdown or Release) against Agile Engineering Data Management 6.2.1 — a lower-severity partial-DoS flaw requiring local low-privilege logon plus third-party user interaction, distinct in weakness class from CVE-2026-61186's uncontrolled-resource-consumption DoS; identified during a deeper research pass via OpenCVE and confirmed directly against NVD.
- Oracle publishes the August 2026 Critical Security Patch Update (cspuaug2026.html) for Oracle Supply Chain products, including nine new fixes for Oracle Agile Engineering Data Management 6.2.1.
- NVD publishes all nine associated CVEs (CVE-2026-71052, -71053, -70691, -70693, -70697, -70698, -70703, -70709, -70712) spanning the Web Services Security, Engineering Communication Interface, and Install components of Agile Engineering Data Management 6.2.1, with CWE assignment still pending analysis for all nine — reconfirmed individually against each NVD JSON API 2.0 record during this research pass, with no new CWE data published since the prior pass.
- Oracle's public advisory page (cspuaug2026.html) and its verbose risk-matrix variant both return HTTP 403 to unauthenticated automated fetch attempts, restricting direct access to the vendor's own per-CVE risk-matrix detail at publication time; re-confirmed unreachable on both pages during this deeper research pass.
- As of this research pass, none of the nine August 2026 CVEs (nor CVE-2026-61186, CVE-2026-61187, or CVE-2026-21969) appear in the CISA Known Exploited Vulnerabilities catalog (re-checked this pass: catalog version 2026.08.18, 1,670 entries), and no public proof-of-concept exploit code, Metasploit module, or exploit-database entry was located for any of them via direct targeted search.
- AusCERT publishes bulletin ASB-2026.0196 tracking the Oracle CSPU for its membership; CVE identifiers, CVSS scores, and resolution guidance are redacted behind AusCERT's member-only portal for non-member access, confirmed unreachable on direct fetch.
Detections & IOCs
As of 2026-09-06, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 9 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, CVE-2026-71052, CVE-2026-71053, CVE-2026-70691, CVE-2026-70693, CVE-2026-70697, CVE-2026-70698, CVE-2026-70703, CVE-2026-70709, CVE-2026-70712, T1595.002, T1190, T1548, T1204, T1213, T1565.001, T1485, T1499.004
