EUVD-2026-24383
GHSA-7mfh-vh4q-xgr5
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-accessible endpoint gated by low-privilege authentication; impact is partial confidentiality only with no integrity or availability loss, scope unchanged.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Agile Product Lifecycle Management for Process accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
AnalysisAI
Information disclosure in Oracle Agile Product Lifecycle Management for Process 6.2.4 allows low-privileged authenticated network attackers to read a subset of application data via HTTP through the Product Quality Management component. The vulnerability carries a CVSS 3.1 score of 4.3 and is classified as CWE-200, reflecting improper exposure of sensitive information. No public exploit code exists and no active exploitation has been identified; EPSS stands at 0.03% (8th percentile), consistent with SSVC's 'exploitation: none' signal.
Technical ContextAI
CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) indicates that the Product Quality Management component of Oracle Agile PLM for Process fails to properly enforce authorization boundaries, allowing data accessible to higher-privileged roles to leak to lower-privileged authenticated users. The affected product (CPE: cpe:2.3:a:oracle_corporation:oracle_agile_product_lifecycle_management_for_process:*:*:*:*:*:*:*:*) is an enterprise web application within Oracle's Supply Chain suite, managing product quality records over HTTP. The attack vector is purely network-based with no complexity barrier beyond possessing valid low-level credentials, consistent with a server-side access control deficiency rather than a client-side or injection flaw.
RemediationAI
Apply Oracle's April 2026 Critical Patch Update, which addresses this vulnerability for Oracle Agile PLM for Process 6.2.4; the advisory is available at https://www.oracle.com/security-alerts/cpuapr2026.html. An exact patched version number beyond the CPU designation is not explicitly stated in the available references - consult the Oracle CPU directly or Oracle Support for the specific build to deploy. As an interim compensating control, restrict access to the Product Quality Management component to only the minimum required roles by tightening application-level role assignments; this reduces the pool of authenticated users who could trigger the disclosure. Additionally, enforce network segmentation so that HTTP access to the PLM application is limited to trusted internal subnets, reducing exposure to external or lateral-movement threat actors. Neither workaround eliminates the underlying flaw; patching via the CPU remains the definitive remediation.
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today