A flaw in Oracle Agile Product Lifecycle Management for Process permits an unauthenticated user to exploit the application over HTTP and gain full control. The vulnerability can be leveraged to compromise confidentiality, integrity, and availability, allowing a remote attacker to take over the entire system. The 8.1 CVSS score reflects severe damage, with no need for privileged credentials.

Oracle Agile Product Lifecycle Management for Process, version 6.2.4, part of Oracle Supply Chain’s Product Quality Management component. The affected product is supplied by Oracle Corporation.

The likely attack path is a network-based HTTP request without authentication, highlighting a lack of proper access control. Attack complexity is high, but the absence of prerequisites like compromised accounts lowers the barrier. The EPSS score of < 1% indicates a very low probability of exploitation, but the high CVSS score of 8.1 means that exploitation would be severe. The vulnerability is not yet catalogued in CISA’s KEV, so no widespread exploitation incidents are reported yet, yet the potential for compromise remains high.