Description

Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: Installation Issues). The supported version that is affected is 3.6.1. Easily exploitable vulnerability allows low privileged attacker with network access via Oracle Net to compromise Oracle Product Lifecycle Analytics. While the vulnerability is in Oracle Product Lifecycle Analytics, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Product Lifecycle Analytics accessible data as well as unauthorized update, insert or delete access to some of Oracle Product Lifecycle Analytics accessible data. CVSS 3.1 Base Score 8.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.5",
  "pubDate": "2026-08-18T21:18:04.713Z",
  "pubdate": "2026-08-18T21:18:04.713Z",
  "executiveSummary": "An easily exploitable vulnerability exists within the Installation Issues component of Oracle Product Lifecycle Analytics version 3.6.1, posing significant security risks to enterprise deployments.\nThe vulnerability allows a low-privileged attacker with network access via Oracle Net to compromise the targeted system, resulting in a scope change that can severely impact additional integrated or co-located products.\nSuccessful exploitation of this flaw grants unauthorized read access to critical data and complete access to all data accessible by Oracle Product Lifecycle Analytics, alongside unauthorized update, insert, or delete capabilities against a subset of the accessible data.\nThe severity of this flaw is reflected by its CVSS 3.1 Base Score of 8.5, driven primarily by high confidentiality and low integrity impacts.\nExploitation requires network connectivity, low privileges, and no user interaction, making network-level access controls and stringent privilege management critical components of the risk mitigation strategy.",
  "technicalDetails": "The vulnerability resides in the Installation Issues component of Oracle Product Lifecycle Analytics version 3.6.1.\nNetwork exposure is facilitated via the Oracle Net protocol, allowing remote adversaries with low-level privileges to interact directly with the vulnerable service without requiring user interaction.\nThe attack vector allows threat actors to leverage network accessibility to bypass standard authorization boundaries, initiating a scope change (S:C) that extends the security impact beyond the primary administrative domain of Oracle Product Lifecycle Analytics to potentially compromise secondary or supporting infrastructure.\nDuring the attack flow, the adversary establishes an Oracle Net session against the vulnerable installation component.\nDue to inadequate access controls and flawed installation or configuration logic within the affected component, the attacker successfully executes unauthorized operations.\nThe post-exploitation impact encompasses severe confidentiality breaches, granting complete access to all sensitive data repositories reachable by the application.\nAdditionally, the attacker gains partial integrity compromise, enabling unauthorized insertion, modification, or deletion of specific data subsets within Oracle Product Lifecycle Analytics.\nThe combination of low privilege requirements (PR:L), low attack complexity (AC:L), and network vector (AV:N) lowers the barrier for successful exploitation, demanding rigorous architectural isolation and protocol-level hardening."
}