A flaw in Oracle Agile Product Lifecycle Management for Process allows a low‑privileged attacker with HTTP network access to fully compromise the application, leading to loss of confidentiality, integrity, and availability. The reported CVSS 3.1 base score is 7.5 with a vector of AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating that the vulnerability can be exploited without special privileges or user interaction and can be used to take over the system.

The vulnerability affects Oracle’s Agile Product Lifecycle Management for Process, version 6.2.4. This is the only version listed as affected in the vendor’s advisories.

The EPSS score is < 1%, indicating a very low but nonzero exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. Nevertheless, a CVSS score of 7.5 denotes a high severity risk. Attackers with network access via HTTP can exploit the weakness and compromise the application, even though the attack requires low privileges and has a moderate difficulty level. The potential impact is system takeover and full loss of security controls.