A flaw exists in the Supplier Portal component of Oracle Agile Product Lifecycle Management for Process that allows an unauthenticated attacker to exploit the system via a standard HTTP request. Once exploited, the vulnerability can compromise the confidentiality, integrity, and availability of the entire application, potentially leading to full takeover. The weakness involves improper authorization controls permitting unauthenticated access and potentially allowing an attacker to take over the application.

Oracle Corporation’s Agile Product Lifecycle Management for Process version 6.2.4 is affected. Users of the Supplier Portal component of this product are at risk.

The base CVSS score is 9.8, indicating critical severity. Although the EPSS score is reported as less than 1 %, reflecting a low but non‑zero probability of exploitation, the lack of a KEV listing does not diminish the need for immediate action. Based on the description, it is inferred that the likely attack vector is network access over HTTP to the vulnerable endpoint, which is exploitable without authentication or advanced privileges.