This vulnerability exists in the Installation component of Oracle Agile Product Lifecycle Management for Process version 6.2.4. It permits a low-privileged attacker with network access over HTTP to compromise the product, potentially resulting in full takeover. The CVSS 3.1 base score is 7.5, indicating high severity with impacts on confidentiality, integrity, and availability. The vulnerability is classified under CWE-306 (Missing Authentication for Critical Function), CWE-287 (Improper Authentication), and CWE-269 (Improper Privilege Management). The vendor advisory references the July 2026 Oracle Critical Patch Update but does not explicitly confirm a patch for this specific vulnerability.

Successful exploitation can lead to complete compromise of Oracle Agile Product Lifecycle Management for Process, affecting confidentiality, integrity, and availability of the system. This could allow unauthorized access and control over the affected product.

Patch status is not yet confirmed—check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until a patch is confirmed, monitor vendor communications for updates.