Description
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Installation). The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Agile Product Lifecycle Management for Process. Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-07-21
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is located in the installation component of Oracle Agile Product Lifecycle Management for Process version 6.2.4. It allows an unauthenticated attacker who can reach the system over TCP to execute arbitrary code. Successful exploitation grants complete control over the application, leading to disclosure of all data and interruption of service.

Affected Systems

Oracle Agile Product Lifecycle Management for Process version 6.2.4 is the only affected product. Any deployments of this version that are reachable from the network are vulnerable until patched.

Risk and Exploitability

The CVSS base score of 9.8 signals critical severity. Although the EPSS score is currently under 1 %, the vulnerability can be exploited remotely with no user interaction or credentials. It is not listed in the CISA KEV catalog, but its high impact and ease of exploitation necessitate prompt remediation.

Generated by OpenCVE AI on August 2, 2026 at 19:34 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply Oracle’s official patch for Agile PDM 6.2.4 as detailed in the CPU July 2026 advisory
  • Block or restrict the TCP ports used by the installation component with firewalls or network segmentation, allowing access only from trusted hosts
  • Continuously monitor authentication and access logs for anomalous activity indicating potential exploitation

Generated by OpenCVE AI on August 2, 2026 at 19:34 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 02 Aug 2026 20:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote Exploit in Oracle Agile PDM Installation Component Enables Full System Compromise

Sat, 01 Aug 2026 04:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated TCP Remote Code Execution in Oracle Agile PDM 6.2.4 Installation Component
Weaknesses CWE-284

Thu, 30 Jul 2026 22:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-306
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 30 Jul 2026 11:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated TCP Remote Code Execution in Oracle Agile PDM 6.2.4 Installation Component
Weaknesses CWE-284
CWE-287

Tue, 28 Jul 2026 19:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated Network Access Leading to Full Compromise in Oracle Agile Product Lifecycle Management for Process
Weaknesses CWE-200
CWE-287

Thu, 23 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated Network Access Leading to Full Compromise in Oracle Agile Product Lifecycle Management for Process
Weaknesses CWE-200
CWE-287

Tue, 21 Jul 2026 22:00:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Installation). The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Agile Product Lifecycle Management for Process. Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle agile Product Lifecycle Management For Process
CPEs cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.4:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle agile Product Lifecycle Management For Process
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Agile Product Lifecycle Management For Process
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-29T03:56:13.489Z

Reserved: 2026-07-08T15:52:20.739Z

Link: CVE-2026-61178

cve-icon Vulnrichment

Updated: 2026-07-23T15:30:39.365Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-02T19:45:06Z

Weaknesses
  • CWE-287

    Improper Authentication

  • CWE-306

    Missing Authentication for Critical Function