Description

Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: Installation Issues). The supported version that is affected is 3.6.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Lifecycle Analytics. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Product Lifecycle Analytics accessible data as well as unauthorized update, insert or delete access to some of Oracle Product Lifecycle Analytics accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Product Lifecycle Analytics. CVSS 3.1 Base Score 7.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.6",
  "pubDate": "2026-08-18T21:18:04.600Z",
  "pubdate": "2026-08-18T21:18:04.600Z",
  "executiveSummary": "An installation-related vulnerability has been identified within the Oracle Product Lifecycle Analytics product of Oracle Supply Chain, specifically affecting version 3.6.1. This security flaw enables a low-privileged authenticated attacker with network access via the HTTP protocol to compromise the target application. Successful exploitation of this vulnerability has severe implications for the confidentiality, integrity, and availability of the system. Specifically, an attacker can achieve unauthorized access to critical data or complete access to all data accessible by Oracle Product Lifecycle Analytics. Furthermore, the vulnerability permits unauthorized update, insert, or delete operations on a subset of accessible data, alongside the capability to induce a partial denial of service condition affecting the application's overall performance and availability. The severity of this issue is reflected in a CVSS 3.1 Base Score of 7.6, highlighting the significant risks posed by unauthorized data manipulation and exposure combined with availability degradation. Exploitation requires network connectivity and low-level privileges, but does not necessitate user interaction, lowering the overall barrier to a successful attack.",
  "technicalDetails": "The vulnerability resides within the Installation Issues component of Oracle Product Lifecycle Analytics version 3.6.1. Root cause analysis of installation-related issues in enterprise analytics platforms typically points to improper default configurations, insecure file permissions, or flawed setup scripts executed during deployment. In this specific scenario, the architectural flaw exposes internal installation artifacts or misconfigured endpoint boundaries over the network via HTTP.\nThe attack flow begins when an authenticated adversary with low privileges leverages network access to transmit crafted HTTP requests targeting vulnerable installation-related endpoints or resources within the Oracle Product Lifecycle Analytics environment. Because the underlying deployment lacks proper access controls or input validation mechanisms during installation configuration, the application processes the requests without adequately verifying whether the requesting low-privileged principal possesses the administrative authorization required to interact with sensitive deployment resources.\nUpon successful transmission of the attack payload, the post-exploitation impact spans multiple security pillars. Regarding confidentiality, the attacker gains unauthorized read access to critical data stores or complete visibility over all data accessible to the Oracle Product Lifecycle Analytics instance, potentially exposing proprietary supply chain intelligence. Regarding integrity, the malicious actor obtains unauthorized capabilities to insert, update, or delete specific segments of accessible data, introducing the risk of data corruption or unauthorized tampering. Finally, regarding availability, the attacker can trigger resource exhaustion or execution faults leading to a partial denial of service (partial DoS), degrading application responsiveness for legitimate users.\nThe attack vector is strictly network-based (AV:N), with low attack complexity (AC:L), requiring low privileges (PR:L) and no user interaction (UI:N). The scope remains unchanged (S:U), impacting confidentiality heavily (C:H) while inducing low impacts on integrity (I:L) and availability (A:L), culminating in the CVSS vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L."
}