Back to CVE Browser

CVE-2024-20953

🔥 Known Exploited (CISA KEV)HIGH

8.8

CVSS Severity Score

EPSS Score0.0000%

EPSS Percentile0.00th

Published2024-02-17

Last Modified2026-06-17

Data SourcesNVDCISA KEV

Vulnerability Description

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Export). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks of this vulnerability can result in takeover of Oracle Agile PLM. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Affected Platforms (CPE)

📦

Oracle

Agile Product Lifecycle Management

= 9.3.6

References & Advisories

🔗 https://www.oracle.com/security-alerts/cpujan2024.html

🔗 https://www.oracle.com/security-alerts/cpujan2024.html

🔗 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-20953

🔗 https://www.zerodayinitiative.com/advisories/ZDI-24-096/

Related Security Intelligence Articles

Global Cyber Intel Digest: July 23, 2026

Key threat updates including CISA's KEV addition of Langflow CVE-2026-0770 remote code execution, unauthenticated path traversal in Windmill CVE-2026-29059, and ongoing incident response guidance for SonicWall SMA1000 zero-day exposures.

Global Cyber Intel Digest: July 21, 2026

Comprehensive breakdown of critical vulnerability advisories across VMware vCenter, F5 BIG-IP, and GitLab platforms, alongside threat actor reconnaissance trends and ransomware response strategies.

Related Vulnerabilities

CVE-2026-148566.3

A stored Cross-Site Scripting (XSS) vulnerability in the file upload functionality of the Media Manager in TastyIgniter v4.3.0, ca...

CVE-2026-400001.8

The Activity zte.com.cn.filer/zte.com.cn.filer.FilePreViewActivity within ZTE File Manager is designed to preview compressed files...

CVE-2026-148378.5

Multiple Lenze products are affected by an improper signature verification vulnerability in the SSH enablement mechanism. A low-pr...

The Download Manager WordPress plugin before 3.3.62 does not bind its temporary download token to the requesting session nor expir...