This vulnerability arises from an insufficiency in access control within Oracle Agile Product Lifecycle Management for Process version 6.2.4, allowing a low–privileged attacker with network HTTP access to modify or delete critical process data. The flaw requires a human interaction from a third party, indicating a social‑engineering component that the attacker must lure or coerce to trigger the exploit. Successful attacks grant the attacker the ability to update, insert, delete, and read sensitive data, creating significant confidentiality and integrity risks that could compromise business processes. The root weakness is classified as CWE‑352.

Only Oracle Agile Product Lifecycle Management for Process version 6.2.4 is listed as affected by the advisory. The vulnerability description notes that a scope change may allow attacks to impact additional products that interface with the vulnerable component, although no other specific products are enumerated.

The CVSS 3.1 base score of 5.4 indicates moderate severity, highlighting modest confidentiality and integrity impact. The EPSS score of <1% indicates a very low probability of exploitation; however, the need for a human interaction from a non‑attacker means that successful attacks could still occur if an environment is reachable over the network and lacks strong access controls. The vulnerability is not listed in the CISA KEV catalog, confirming no publicly available exploits. Likely attack vector involves low‑privileged HTTP access combined with a social‑engineering requirement, so the exploitation risk remains low but present.