Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2024-21287

CVE-2024-21287HIGH

Oracle Agile Product Lifecycle Management (PLM)

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  N  N    7.5   .0172   76.7   YES

AFFECTED
  Product                     Versions  Fixed
  Oracle Agile PLM Framework  9.3.6 –   —

TIMELINE
  Dec 7   Reserved by oracle
  Nov 18  Published (CNA: oracle)
  Nov 21  Added to CISA KEV, remediation due 2024-12-12

CWE-863 · CNA: oracle · CVSS v3.1 · 2 references · KEV due December 12, 2024

Description

Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Software Development Kit, Process Extension). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM Framework. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Agile PLM Framework accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
December 7, 2023	Reserved	Reserved by oracle
November 18, 2024	Published	Published (CNA: oracle)
November 21, 2024	KEV ADDED	Added to CISA KEV, remediation due 2024-12-12

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
Oracle Corporation	Oracle Agile PLM Framework	—	9.3.6	—

Weaknesses

CWE-863

References (2)

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-21287 [government-resource]
https://www.oracle.com/security-alerts/alert-cve-2024-21287.html [vendor-advisory]

Authoritative record: CVE-2024-21287 at cve.org

Vendors: oracle

Weaknesses: CWE-863

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2024-21287 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.