This vulnerability affects Oracle Agile Product Lifecycle Management for Process 6.2.4, specifically in the installation component. An unauthenticated attacker with physical network segment access can exploit this flaw to compromise the product, resulting in unauthorized access to critical or all accessible data. The CVSS vector indicates attack vector as adjacent network (AV:A), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), scope changed (S:C), high confidentiality impact (C:H), no integrity or availability impact (I:N/A:N). The vulnerability may impact other Oracle products due to scope change. Oracle has published a Critical Patch Update advisory for July 2026 but does not explicitly confirm a patch for this specific vulnerability in the provided content.

Successful exploitation allows unauthorized access to critical or all data accessible by Oracle Agile Product Lifecycle Management for Process 6.2.4. The confidentiality of sensitive information is severely impacted. There is no reported impact on integrity or availability. The vulnerability requires physical access to the communication segment, limiting remote exploitation. The scope change indicates potential impact on additional Oracle products beyond the initially affected product.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively-supported versions. Until a patch is confirmed and applied, restrict physical access to the communication segments attached to the affected hardware to mitigate exploitation risk.