Oracle Agile Engineering Data Management (Agile EDM) is the engineering/PLM data-management module of Oracle's legacy on-premises Agile PLM suite, used by product-centric organizations in manufacturing, aerospace and defense, automotive, industrial equipment, high-technology, life-sciences, and consumer-goods sectors to manage bills of materials, engineering change orders, and product records. Per Oracle's own Agile EDM Security Guide (edmsc.pdf), the product runs as a WebLogic/J2EE application, exposes its Engineering Communication Interface (ECI) as a web-service endpoint, and authenticates users via LDAP, Kerberos-based Java-client SSO, or WebLogic SAML SSO, typically fronted by an Apache HTTPD SSL reverse proxy — the 'Web Services Security' component patched in this CSPU is the layer responsible for enforcing those authentication/authorization boundaries on ECI's HTTP/SOAP surface. On 2026-08-18 Oracle's August Critical Security Patch Update (CSPU, cspuaug2026.html) for the Oracle Supply Chain product family patched nine new CVEs against Agile EDM version 6.2.1, all published to NVD the same day and all referencing the CSPU advisory; NVD has not yet published CWE assignments for any of the nine as of this research pass (re-verified directly against each of the nine individual NVD JSON API 2.0 records this pass — a typical lag for freshly disclosed vendor-sourced CVEs, and consistent with the vendor advisory page itself, plus its verbose risk-matrix variant, both still returning HTTP 403 to unauthenticated automated fetch).

The two highest-severity flaws are both in the Web Services Security component: CVE-2026-71052 (CVSS 3.1 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) lets a low-privileged, network-based attacker reach full compromise via an 'easily exploitable' HTTP-reachable flaw, and CVE-2026-71053 (CVSS 3.1 8.1, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) is a 'difficult to exploit' unauthenticated variant of the same weakness — together matching the AusCERT/hunt-stage description of 'an unauthenticated attacker... via HTTP' plus 'a separate... flaw allowing a low-privileged network attacker to potentially take over the product.' A second cluster of five CVEs affects the Engineering Communication Interface component with materially different attack profiles confirmed against NVD: CVE-2026-70703 (CVSS 8.2, AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N — scope-changed, network-exploitable, unauthorized create/delete/modify of critical data); CVE-2026-70709 (CVSS 4.8, AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N — unauthenticated network attacker gets unauthorized read access to a subset of data plus unauthorized update/insert/delete on accessible data — Oracle's own NVD-sourced description explicitly names both the read and the write/delete access, the strongest textual evidence in this batch for a data-manipulation impact); CVE-2026-70697 (CVSS 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H — local low-privileged attacker, difficult to exploit, full takeover); CVE-2026-70693 (CVSS 6.3, AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H — local high-privileged attacker AND user interaction from a separate party required); and CVE-2026-70691 (CVSS 7.5, AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H — unauthenticated attacker with physical/adjacent-network access to the communication segment, full takeover). Two remaining CVEs affect the Install component and require existing high-privilege local logon to the infrastructure: CVE-2026-70698 (CVSS 6.7, AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, easily exploitable) and CVE-2026-70712 (CVSS 6.4, AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H, difficult to exploit) — both describe an already-privileged local user abusing a flaw in the Install component's execution path to escalate beyond their granted scope to complete product takeover, rather than gaining privilege from an unprivileged baseline.

Agile EDM 6.2.1 has a recurring pattern of critical, unauthenticated, network-reachable flaws in this same Web Services Security component, and this research pass confirmed a third sibling in the pattern beyond what was previously documented. Oracle's prior CPU one month earlier (cpujul2026.html, 2026-07-21) disclosed two CVEs against the identical product/version: CVE-2026-61186 (CVSS 3.1 9.4, AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H), unauthenticated-network-HTTP, explicitly granting 'unauthorized creation, deletion or modification access to critical data' and causing denial-of-service, classified under CWE-284 (Improper Access Control), CWE-306 (Missing Authentication for Critical Function), CWE-400 (Uncontrolled Resource Consumption), and CWE-732 (Incorrect Permission Assignment); and CVE-2026-61187 (CVSS 3.1 2.8, AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L, CWE-404 Improper Resource Shutdown or Release), a lower-severity flaw requiring local low-privilege access AND user interaction from a third party to trigger a partial denial of service — a distinct resource-handling weakness class from CVE-2026-61186's uncontrolled-consumption DoS. These July CWEs are confirmed only for the two July sibling flaws, not (yet) assigned to the nine August CVEs, but describe the same weakness classes recurring in the same component/product. A sibling Oracle Agile product, Agile Product Lifecycle Management for Process (Supplier Portal component, v6.2.4), separately received a CVSS 9.8 unauthenticated RCE-class fix (CVE-2026-21969, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 'easily exploitable... can result in takeover') via the January 2026 CPU. As of this research (2026-08-18), none of the eleven Agile EDM/Agile PLM CVEs identified across the three most recent Oracle patch cycles (the nine August CVEs, CVE-2026-61186, CVE-2026-61187, and CVE-2026-21969) appear in the CISA KEV catalog (re-checked this pass: catalog version 2026.08.18, 1,670 entries, no matches), and no public proof-of-concept exploit code, Metasploit module, or exploit-database entry was located for any of them via direct search. The originating AusCERT bulletin (ASB-2026.0196) is member-gated — confirmed unreachable (login wall) on direct fetch — consistent with the HUNT-stage finding that Oracle's own advisory page (cspuaug2026.html and its verbose risk-matrix variant, both re-checked this pass) returns HTTP 403 to unauthenticated automated fetches.

The broader Oracle Agile PLM product family has a documented history of active exploitation that is directly relevant context for exploitability assessment, even though it involves a different, now-discontinued product version. On 2024-11-20 Oracle patched CVE-2024-21287 (CVSS 7.5), an unauthenticated information-disclosure flaw in Oracle Agile Product Lifecycle Management (Agile PLM) version 9.3.6 — discovered and reported by CrowdStrike researchers Joel Snape and Lutz Wolf — that was under active in-the-wild exploitation prior to patching: per Oracle VP of security assurance Eric Maurice, 'an unauthenticated perpetrator could download, from the targeted system, files accessible under the privileges used by the PLM application,' granting 'complete access to all Agile PLM Framework accessible data' with no authentication. Agile PLM 9.3.6 was discontinued by Oracle in April 2024 (premier support ends 2027-12-31) and is a materially different codebase/version from the currently-supported Agile EDM 6.2.1 branch this threat concerns — this precedent is NOT evidence that any of the August 2026 or July 2026 CVEs are being exploited, but it establishes that unauthenticated, HTTP-reachable data-access flaws in the Oracle Agile product line have previously been targeted by real-world attackers, reinforcing the priority of patching the current CSPU promptly despite the absence of KEV/PoC evidence for these specific CVEs.