CVE-2026-34296
Unauthorized Data Access via Network in Oracle Agile PLM
Publication date: 2026-04-21
Last updated on: 2026-04-23
Assigner: Oracle
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| oracle | agile_product_lifecycle_management_for_process | 6.2.4 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-200 | The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Oracle Agile Product Lifecycle Management for Process product, specifically in the Product Quality Management component. It affects version 6.2.4 and allows a low privileged attacker with network access via HTTP to exploit the system easily.
Successful exploitation can lead to unauthorized read access to some of the data accessible within Oracle Agile Product Lifecycle Management for Process.
How can this vulnerability impact me? :
The impact of this vulnerability is primarily on confidentiality. An attacker with low privileges and network access could gain unauthorized read access to certain data within the Oracle Agile Product Lifecycle Management for Process system.
There is no impact on integrity or availability according to the CVSS score.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows unauthorized read access to a subset of data within Oracle Agile Product Lifecycle Management for Process. Such unauthorized data access could potentially lead to non-compliance with data protection regulations like GDPR and HIPAA, which require strict controls on access to sensitive or personal data.
However, the provided information does not specify the nature of the data exposed or whether it includes personal or protected health information, so the exact impact on compliance with these standards cannot be determined from the given data.