Oracle Agile Product Lifecycle Management for Process 6.2.4 includes a weakness that allows an unauthenticated attacker to create, delete, or modify data over HTTP. The flaw permits unauthorized creation and manipulation of critical data, leading to confidentiality and integrity loss as described in the CVSS vector. This type of issue corresponds to an improper access control weakness, as the system fails to enforce proper authorization checks before allowing sensitive operations.

The affected product is Oracle Corporation’s Agile Product Lifecycle Management for Process version 6.2.4, part of Oracle Supply Chain’s Product Quality Management component. No other versions or products are listed as affected.

The vulnerability scores a CVSS 3.1 base score of 9.3, indicating a high severity level. The EPSS score is not available and the issue is not listed in CISA KEV, but the attack requires network access over HTTP and is unauthenticated, yet it necessitates user interaction by a third party. Because this flaw can be used to compromise all accessible data in the system, the potential impact is significant. The lack of a published EPSS score means the exploitation probability is uncertain, but the high CVSS score and the design of the flaw suggest a serious risk if left unmitigated.