A weakness in Oracle Agile Product Lifecycle Management for Process allows a low‑privileged attacker with network access via HTTP to compromise the product. Successful exploitation can lead to a complete takeover of the system, providing the attacker full confidentiality, integrity and availability control. The CVSS 3.1 score of 7.5 reflects the severe impact on all three core security properties.

Oracle’s Agile Product Lifecycle Management for Process version 6.2.4, specifically the Product Quality Management component.

The vulnerability is reachable remotely over HTTP; an attacker only needs to be authenticated at a low privilege level to launch the attack. Although the EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, the high CVSS score indicates that exploitation would be highly damaging. The attack would likely involve sending a crafted request over the network, but the exact mechanism is not detailed in the advisory.