CVE-2024-20953

HIGH

8.8

CVSS Score

Published: February 17, 2024 at 01:50 AM UTC

Updated: June 17, 2026 at 07:08 AM UTC

2 products affected across 1 vendorAgile Product Lifecycle ManagementAgile Plm Framework

Using Agile PLM Framework by Oracle Corporation?

Get instant alerts when new vulnerabilities affect Agile PLM Framework - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH8.8

Exploitation

CISA KEV

Exploit prediction

EPSS 4%

SSVC

Active

Actively Exploited

CISA Known Exploited Vulnerabilities (KEV) Catalog

EPSS Score3.9%

EPSS (Exploit Prediction Scoring System) estimates a 3.9% chance this CVE is exploited in the wild within the next 30 days — higher than 90% of all CVEs. It complements CVSS: a high EPSS on a mid-severity CVE can still be urgent.

Oracle Agile Product Lifecycle Management (PLM) contains a deserialization vulnerability that allows a low-privileged attacker with network access via HTTP to compromise the system.

Required Action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Ransomware Use

Unknown

Added to KEV

Feb 24, 2025

Remediation Due

Mar 17, 2025

593 days overdue

Notes

https://www.oracle.com/security-alerts/cpujan2024.html

https://nvd.nist.gov/vuln/detail/CVE-2024-20953

Description

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Export). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks of this vulnerability can result in takeover of Oracle Agile PLM. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).