This vulnerability affects Oracle Agile Product Lifecycle Management for Process, specifically version 6.2.4. It permits an unauthenticated attacker with network access over HTTP to gain unauthorized access to the system, enabling creation, deletion, or modification of critical data or all data accessible through the product. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) reflects that the attack requires no privileges or user interaction and can be performed remotely with low complexity, resulting in high confidentiality and integrity impact but no availability impact. The vendor advisory from Oracle (July 2026 Critical Patch Update) lists this vulnerability among many addressed but does not explicitly confirm patch availability or remediation status for this specific version. No known exploits in the wild are reported at this time.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or all data accessible via Oracle Agile Product Lifecycle Management for Process version 6.2.4. This compromises confidentiality and integrity of the affected system's data, potentially impacting business operations relying on this data. There is no reported impact on system availability.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. However, the vendor advisory does not explicitly confirm patch availability or provide a specific remediation level for version 6.2.4. Customers are strongly advised to consult the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch information and apply any relevant patches promptly. Until a patch is confirmed and applied, restrict network access to the affected service where possible to reduce exposure.