CISA reports active exploitation of Oracle AgilePLM flaws
Take action: If you are a year late to patch your Oracle PLM, high time to catch up. Because hackers are about to make you catch up.
Learn More
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is reporting active exploitation of flaw in Oracle Agile Product Lifecycle Management (PLM) system.
The exploited flaw is tracked as CVE-2024-20953 (CVSS score 8.8), it's vulnerability in Oracle Agile PLM's Export component that allows low-privileged attackers with network access via HTTP to compromise the system. It affects Oracle Agile PLM version 9.3.6 and can result in complete takeover of Oracle Agile PLM systems. It was fixed in January 2024
CISA has confirmed active exploitation but hasn't provided any details about the attack campaigns. Another Oracle Agile PLM vulnerability (CVE-2024-21287, CVSS score: 7.5) was actively exploited in late 2023.
CISA recommends that all organizations apply the necessary updates. Federal agencies are required to secure their networks against these threats by March 17, 2025.
