This vulnerability arises from an insufficiency in access control within Oracle Agile Product Lifecycle Management for Process version 6.2.4, allowing a low‑privileged attacker with network HTTP access to modify or delete critical process data. The flaw requires a human interaction from a third party, indicating a social‑engineering component that the attacker must lure or coerce to trigger the exploit. Successful attacks grant the attacker the ability to update, insert, delete, and read sensitive data, creating significant confidentiality and integrity risks that could compromise business processes. The root weakness is an improper access control mechanism (CWE‑284).

Only Oracle Agile Product Lifecycle Management for Process version 6.2.4 is listed as affected by the advisory. The vulnerability description notes that a scope change may allow attacks to impact additional products that interface with the vulnerable component, although no other specific products are enumerated.

The CVSS 3.1 base score of 5.4 signals a moderate severity, reflecting moderate confidentiality and integrity impact. EPSS scoring is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed public exploits to date. The likely attack vector involves low‑privilege network access to the HTTP endpoint, coupled with a social‑engineering requirement; therefore the exploitation probability is currently moderate but not negligible, especially for environments that expose the application to untrusted networks or lack tight access controls.