A flaw in Oracle Agile Product Lifecycle Management for Process enables a low‑privileged user with network access over HTTP to compromise the entire application. Successful use of the vulnerability can lead to full takeover, exposing, modifying, or deleting all data and disrupting the service. The CVSS 3.1 base score of 8.8 reflects high confidentiality, integrity, and availability impact.

Oracle Agile Product Lifecycle Management for Process, version 6.2.4, specifically the Product Quality Management component.

The vulnerability’s vector is through HTTP requests, requiring only low‑privileged credentials; it does not require elevated privileges or local access. The CVSS score indicates a high level of risk while the EPSS score is not available and the issue is not listed in CISA’s KEV catalog. Because the flaw can be triggered by an attacker who has limited access to the web interface, the risk of exploitation is significant and should be treated as a priority.