CVE-2024-21287
Published 2024-11-18 · Updated 2026-06-17 · Source secalert_us@oracle.com
Summary
CVE-2024-21287 is a high-severity (CVSS 7.5) vulnerability in Oracle Agile Product Lifecycle Management (PLM). CISA added it to the Known Exploited Vulnerabilities catalog on November 21, 2024, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by December 12, 2024. CISA does not currently list it as used in ransomware campaigns. Oracle has 46 vulnerabilities in the KEV catalog, 13 of them linked to ransomware.
All 46 known-exploited Oracle vulnerabilities →Description
Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Software Development Kit, Process Extension). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM Framework. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Agile PLM Framework accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CISA Known-Exploited Vulnerability
Product: Oracle — Agile Product Lifecycle Management (PLM)
Name: Oracle Agile Product Lifecycle Management (PLM) Incorrect Authorization Vulnerability
Date added: 2024-11-21 · Due: 2024-12-12
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.