FAIL › dossier
Agile Product Lifecycle Management (PLM)
PRODUCT· dossier confidence 50%
Oracle Agile PLM is a critical enterprise software product with a severely compromised security posture, evidenced by active exploitation of high-severity remote code execution and file disclosure vulnerabilities. The product's SDK and core deserialization mechanisms are primary attack vectors, requiring immediate patching and architectural review for defense-industrial-base compliance.
PROFILE
CategoryEnterprise SoftwareWhat they doOracle Agile PLM is a product lifecycle management software used by organizations to manage product development processes, data, and collaboration.
SECURITY POSTURE
The security posture is compromised by active exploitation of high-severity vulnerabilities, including remote code execution via deserialization and unauthenticated file disclosure, indicating critical gaps in authorization and patch management.
Notable failures
- CVE-2024-20953: Active RCE via deserialization
- CVE-2024-21287: Unauthenticated file disclosure
- Active exploitation of CVE-2024-20953
Patterns: High-severity deserialization vulnerabilities; Unauthenticated file disclosure via SDK; Active exploitation of known vulnerabilities
FAILURE HISTORY · 2
| DATE | EVENT | SEV | SUMMARY |
|---|---|---|---|
| 2025-02-24 | CVE-2024-20953 | high | Oracle Agile PLM has a deserialization vulnerability actively exploited by attackers to compromise systems via HTTP network access. |
| 2024-11-21 | CVE-2024-21287 | high | Oracle PLM SDK allows unauthenticated file disclosure via incorrect authorization in Process Extension. |
Open questions: Current patch status for CVE-2024-20953 and CVE-2024-21287 · Specific Oracle patch release notes for these CVEs
DOSSIER · dex-RAG synthesis · grounded in our own collection + trusted sourcesbuilt 2026-09-06 04:03:28.340673+00:00