This vulnerability affects Oracle Agile Product Lifecycle Management for Process version 6.2.4, specifically the Product Quality Management component. It is exploitable remotely over HTTP by a low privileged attacker but requires user interaction from a third party. The vulnerability can result in unauthorized access to sensitive data and unauthorized update, insert, or delete operations on some accessible data. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, required user interaction, scope change, high confidentiality impact, low integrity impact, and no availability impact. Oracle's July 2026 Critical Patch Update advisory references this vulnerability among many others but does not explicitly state a patch for version 6.2.4. Customers are advised to apply available patches promptly and remain on supported versions.

Successful exploitation can lead to unauthorized access to critical data and unauthorized modification (update, insert, delete) of some data within Oracle Agile Product Lifecycle Management for Process. The vulnerability impacts confidentiality and integrity but does not affect availability. Due to scope change, other Oracle products may also be significantly impacted.

Oracle's July 2026 Critical Patch Update advisory includes this vulnerability in its list but does not explicitly confirm a patch for version 6.2.4. Customers should consult the advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and apply all relevant security updates without delay. Until a patch is confirmed and applied, organizations should consider limiting network exposure of the affected product and enforce strict user interaction policies to reduce risk. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance.