Oracle Agile Product Lifecycle Management for Process version 6.2.4 contains a difficult‑to‑exploit flaw that enables an attacker with limited privileges and network access via HTTP to gain unauthorized access to critical data. An attacker can also obtain complete access to all data exposed by the product and trigger a partial denial of service that disrupts availability for some users. The weakness results in confidentiality impact and mild availability impact.

The vulnerability affects Oracle Corporation’s Agile Product Lifecycle Management for Process, specifically version 6.2.4. Only this version is known to be impacted; no other versions are listed as vulnerable.

The CVSS base score of 5.9 reflects moderate severity, with an attacker able to bypass access controls (low privilege) over the network. The exploit does not require local privileges and can be carried out remotely. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, indicating that known exploitation activity has not been reported. Nonetheless, the ability to gain data access and disrupt services warrants prompt remediation. The likely attack vector is HTTP traffic entering the application, suggesting that network‑level controls could mitigate or reduce risk.