This vulnerability affects Oracle Agile Product Lifecycle Management for Process, specifically version 6.2.4. It allows an attacker with low privileges and network access via HTTP to compromise the system, resulting in complete takeover. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impacts on confidentiality, integrity, and availability. The vulnerability is related to weaknesses identified by CWEs 306 (Missing Authentication for Critical Function), 287 (Improper Authentication), 269 (Improper Privilege Management), and 284 (Improper Access Control). Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly state patch availability or remediation details for this product version. No known exploits in the wild have been reported.

Successful exploitation allows an attacker with low privileges and network access to fully compromise Oracle Agile Product Lifecycle Management for Process version 6.2.4. This results in complete loss of confidentiality, integrity, and availability of the affected system, effectively enabling takeover of the product.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory for current remediation guidance at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle strongly recommends applying security patches promptly once they become available and remaining on actively supported versions. Until a patch is confirmed, restrict network access to the affected product and monitor for unusual activity.