VulnRadar

Data against noise.

Page generated: 11 Nov 2026, 11:13 UTC

CVE-2024-21287

Read full description

Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Software Development Kit, Process Extension). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM Framework. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Agile PLM Framework accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

CVSS 7.5 (HIGH) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE

0.0/10

REALITY · THREAT PRIORITY

8.1/10

General review priority; not probability

Evidence confidence: Exploitation recorded

Why this priority?

Recorded exploitation baseline: +7.00
Technical severity: CVSS 7.5: +1.12
Fresh EPSS: 1.72%: +0.01

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 8 documents and public datasets.

Hype components

Headline sample (25%)

0/100

Press, 30 days (60%)

0/100

Grounded branding (15%)

0/100

HYPE TOTAL0/100

Sources and documents

CyberSecurityNews

Press · 25 Feb 2025, 08:00 · CISA Warns of Oracle Agile Vulnerability Exploited in the Wild - CyberSecurityNews

The Hacker News

Press · 25 Feb 2025, 08:00 · Two Actively Exploited Security Flaws in Adobe and Oracle Products Flagged by CISA - The Hacker News

SecurityWeek

Press · 25 Feb 2025, 08:00 · CISA Warns of Attacks Exploiting Oracle Agile PLM Vulnerability - SecurityWeek

Oracle Blogs

Press · 28 Jan 2025, 08:00 · Oracle Critical Patch Update Advisory – January 2025 - Oracle Blogs

The Hacker News

Press · 22 Jan 2025, 08:00 · Oracle Releases January 2025 Patch to Address 318 Flaws Across Major Products - The Hacker News

See all 8 source documents

SecurityWeek

Press · 20 Nov 2024, 08:00 · Oracle Patches Exploited Agile PLM Zero-Day - SecurityWeek

Help Net Security

Press · 19 Nov 2024, 08:00 · Oracle patches exploited Agile PLM vulnerability (CVE-2024-21287) - Help Net Security

BleepingComputer

Press · 19 Nov 2024, 08:00 · Oracle warns of Agile PLM file disclosure flaw exploited in attacks - BleepingComputer

Score evolution

● Hype ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

First record: hype 0.0 · reality 8.1 (2026-11-02 15:13). The curve appears once the score changes.

Public exploit evidence

Public exploit entries / repo candidates

Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence: Exploitation recorded
Priority basis: Recorded exploitation; CVSS 7.5; EPSS 1.7%
Attention, last 30 days: 0 distinct story titles; 0 press documents; 0 publisher domains.
Technical potential: network access, no prior privileges, no user interaction.
Observed activity: Exploitation recorded in CISA KEV.
Known scale: Not quantified.
Evidence confidence basis: Trusted exploitation confirmation

Score evaluated: 2026-11-05 13:59:08.088796+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Source event timeline

Published

18 Nov 2024, 21:39

First press mention

19 Nov 2024, 08:00

Added to the CISA KEV catalog

21 Nov 2024, 00:00

Latest press mention

25 Feb 2025, 08:00

Score calculated

05 Nov 2026, 13:59