This vulnerability affects Oracle Agile Product Lifecycle Management for Process version 6.2.4, specifically in the Product Quality Management component. It is easily exploitable by an attacker with low privileges who has network access via HTTP. Successful exploitation can result in complete compromise of the affected product, impacting confidentiality, integrity, and availability. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. The vendor advisory references a Critical Patch Update released in July 2026 covering multiple products, including Oracle Agile PLM 6.2.4, but does not explicitly confirm a patch for this vulnerability in the provided text.

The vulnerability allows an attacker with low privileges and network access via HTTP to fully compromise Oracle Agile Product Lifecycle Management for Process version 6.2.4. This results in complete loss of confidentiality, integrity, and availability of the affected product, effectively enabling takeover of the system.

Oracle has released a Critical Patch Update advisory in July 2026 that includes patches for Oracle Agile Product Lifecycle Management for Process version 6.2.4. Customers are strongly advised to review the advisory at https://www.oracle.com/security-alerts/cpujul2026.html and apply the relevant patches promptly. Patch status for this specific vulnerability is not explicitly confirmed in the advisory content provided; therefore, customers should verify patch availability and installation instructions from Oracle's official resources. Maintaining actively supported versions and timely patch application is critical to mitigate this vulnerability.