CVE-2024-20953

CVE-2024-20953 is an insecure deserialization vulnerability (CWE-502) in the Export component of Oracle Agile Product Lifecycle Management (PLM), part of Oracle Supply Chain. A low-privileged authenticated attacker can trigger it over HTTP by sending crafted serialized data to the Export functionality; the flaw is easily exploitable and requires no user interaction. Successful exploitation lets the attacker take over the Agile PLM application, with high impact on confidentiality, integrity, and availability (CVSS 3.1 score 8.8). Only Agile PLM 9.3.6 is listed as affected, so organizations running that version — typically enterprises using Agile PLM to manage product lifecycle data — are in scope. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2025-02-24, confirming exploitation in the wild, though no public proof-of-concept is known and use in ransomware campaigns is unconfirmed (EPSS: ~3.9% probability of exploitation in 30 days).

What to do: Apply the fix Oracle shipped for this CVE in its January 2025 Critical Patch Update for Agile PLM 9.3.6; if patching is delayed, restrict HTTP access to the Export component and apply vendor mitigations per CISA's KEV required action, or discontinue use of the product if mitigations are unavailable. Review HTTP logs and the Export component for signs of exploitation, and audit which low-privileged accounts can reach the application, since only limited credentials are needed to attack it.