This vulnerability affects Oracle Agile Product Lifecycle Management for Process, specifically version 6.2.4, in the Data Import component. It is exploitable by an attacker who already has high privileges and logon access to the infrastructure running the product. Successful exploitation can lead to complete compromise of the Oracle Agile Product Lifecycle Management for Process environment. The CVSS vector indicates local attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impacts on confidentiality, integrity, and availability. The vendor advisory references the July 2026 Critical Patch Update, which includes many patches across Oracle products, but does not explicitly confirm a patch for this vulnerability or provide remediation details.

An attacker with high privileges and logon access to the infrastructure can exploit this vulnerability to fully compromise Oracle Agile Product Lifecycle Management for Process version 6.2.4. This results in complete loss of confidentiality, integrity, and availability of the affected product instance. There are no known exploits in the wild reported at this time.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory for current remediation guidance at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle strongly recommends applying all relevant security patches promptly. Until a patch is confirmed and applied, restrict high privileged access to the infrastructure where Oracle Agile Product Lifecycle Management for Process executes to trusted personnel only.