A vulnerability was discovered in Oracle’s Agile Product Lifecycle Management for Process, version 6.2.4, that permits an unauthenticated attacker with network connectivity through HTTP to compromise the application. Successful exploitation allows the attacker to create, delete, or modify critical data, as well as to gain unauthorized access to any data accessible through the system. The impact is a loss of confidentiality and integrity for all Oracle Agile Product Lifecycle Management for Process data. The weakness underlying this flaw is improper access control, as reflected in its CVSS 3.1 score of 7.4.

The affected product is Oracle Corporation’s Agile Product Lifecycle Management for Process, specifically version 6.2.4. No other versions are listed as impacted.

The flaw carries a high severity rating according to CVSS, indicating significant potential damage. The attack vector is network‑based and requires no authentication, though the exploit is described as difficult. EPSS information is not available, and the vulnerability is not currently listed in the CISA KEV catalog, suggesting it is not widely deployed yet but could be a high‑value target for attackers who identify the otherwise obscure flaw.