Oracle Agile Product Lifecycle Management for Process version 6.2.4 contains a flaw that allows any external user to access the application over HTTP without authentication. The weakness is a missing authentication check (CWE‑306) and results in the ability to read, insert, update and delete data that the application exposes. The impact is a high confidentiality breach combined with low to moderate integrity loss for all data accessible through the affected component.

Oracle Corporation’s Agile Product Lifecycle Management for Process, version 6.2.4, deployed as the Supply Chain Product Quality Management module.

The flaw has a CVSS 3.1 base score of 8.2, classifying it as high severity. The EPSS score of less than 1 % indicates a very low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Attackers can reach the component via normal network traffic on HTTP without any credentials or user interaction, making the attack surface wide but the exploitation likelihood low compared to other high‑severity bugs.