This vulnerability affects Oracle Agile Product Lifecycle Management for Process version 6.2.4, specifically within the Product Quality Management component. It permits a low privileged attacker with network access over HTTP to exploit the system without user interaction, resulting in complete compromise of the product. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory references this product and version but does not explicitly confirm patch availability or remediation status for this vulnerability.

Successful exploitation can lead to full takeover of Oracle Agile Product Lifecycle Management for Process version 6.2.4, impacting confidentiality, integrity, and availability of the system. This could allow attackers to access sensitive data, modify or disrupt system operations, and potentially control the affected product environment.

Oracle's July 2026 Critical Patch Update advisory mentions multiple security patches but does not explicitly confirm a patch for this vulnerability in version 6.2.4. Customers are strongly advised to review the advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and apply all relevant security updates promptly. Until an official patch or fix is confirmed, organizations should limit network exposure of the affected product and monitor for unusual activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.