Oracle Agile Product Lifecycle Management (PLM) Deserialization Vulnerability

HIGH 8.8EXPLOITED (CISA KEV)CVE-2024-20953 · Published 17/02/2024 · updated 17/06/2026

Oracle Agile Product Lifecycle Management (PLM) Deserialization Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 24/02/2025. Patch affected systems as an emergency.

Package	Affected versions	Patched versions
agile product lifecycle management oracle	`= 9.3.6`	No fix yet

Description

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Export). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks of this vulnerability can result in takeover of Oracle Agile PLM. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

References

oracle.com/security-alerts/cpujan2024.html · Vendor Advisory
cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
zerodayinitiative.com/advisories/ZDI-24-096 · Third Party Advisory
CISA KEV · CVE-2024-20953

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free