CVE-2025-21556: Buffer Overflow
First published: Tue Jan 21 2025(Updated: )
Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Agile Integration Services). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM Framework. While the vulnerability is in Oracle Agile PLM Framework, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Agile PLM Framework. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
Credit: secalert_us@oracle.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Oracle Agile Product Lifecycle Management Framework |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Peer vulnerabilities
(Found alongside the following vulnerabilities)
Frequently Asked Questions
What is the severity of CVE-2025-21556?
CVE-2025-21556 is categorized as an easily exploitable vulnerability with potential significant impact.
How do I fix CVE-2025-21556?
To fix CVE-2025-21556, update your Oracle Agile PLM Framework to the latest version provided by Oracle.
Who is affected by CVE-2025-21556?
Organizations using Oracle Agile PLM Framework version 9.3.6 are specifically affected by CVE-2025-21556.
What types of attacks can exploit CVE-2025-21556?
CVE-2025-21556 can be exploited by low privileged attackers with network access via HTTP.
What component of Oracle is impacted by CVE-2025-21556?
CVE-2025-21556 impacts the Agile Integration Services component of the Oracle Agile PLM Framework.
- agent/first-publish-date
- agent/type
- collector/nvd-api
- source/NVD
- agent/author
- agent/description
- agent/softwarecombine
- collector/the-register
- source/The Register
- alias/CVE-2025-21556
- alias/CVE-2024-45492
- alias/CVE-2023-46604
- alias/CVE-2024-56337
- agent/news-ai
- agent/severity
- agent/references
- agent/source
- agent/weakness
- agent/event
- agent/trending
- agent/tags
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- collector/epss-latest
- source/FIRST
- agent/epss
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/oracle
- canonical/oracle agile product lifecycle management framework