This vulnerability affects Oracle Agile Product Lifecycle Management for Process, specifically version 6.2.4. It is an easily exploitable flaw that permits unauthenticated attackers with network access via HTTP to compromise the system. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or all accessible data within the product. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts. The vulnerability is categorized under CWE-284 (Improper Access Control). The vendor advisory references a Critical Patch Update but does not explicitly confirm a patch for this specific vulnerability yet.

The vulnerability allows an unauthenticated remote attacker to gain unauthorized access to critical data and perform unauthorized creation, deletion, or modification of data within Oracle Agile Product Lifecycle Management for Process. This can compromise the confidentiality and integrity of the data managed by the product. There is no indication of availability impact. No known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly once available and remaining on actively supported versions. Until a patch is confirmed, restrict network access to the affected service where possible to reduce exposure.