CVE-2024-20953

Oracle Agile Product Lifecycle Management (PLM) Deserialization Vulnerability

Oracle — Agile Product Lifecycle Management (PLM)

Added to KEV catalog: 24 February 2025
Federal remediation due date: 17 March 2025
Weakness classification (CWE): CWE-502

CISA Description

Oracle Agile Product Lifecycle Management (PLM) contains a deserialization vulnerability that allows a low-privileged attacker with network access via HTTP to compromise the system.

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Notes

https://www.oracle.com/security-alerts/cpujan2024.html ; https://nvd.nist.gov/vuln/detail/CVE-2024-20953

View on NVD View on MITRE CVE View full CISA catalog

More Oracle Vulnerabilities

CVE-2026-21962

Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability

CVE-2026-46817

Oracle E-Business Suite Improper Privilege Management Vulnerability

CVE-2026-35273

Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability

CVE-2024-21182

Oracle WebLogic Server Unspecified Vulnerability

CVE-2025-61757

Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability

Confirm Your Exposure

Is this vulnerability present in your environment?

CRS delivers independent VAPT assessments that identify exactly which known-exploited vulnerabilities exist in your network, applications, and infrastructure.

Explore VAPT Services