CVE-2026-61174 in Product Lifecycle Analytics
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: Installation Issues). The supported version that is affected is 3.6.1. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Product Lifecycle Analytics executes to compromise Oracle Product Lifecycle Analytics. While the vulnerability is in Oracle Product Lifecycle Analytics, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Product Lifecycle Analytics accessible data as well as unauthorized access to critical data or complete access to all Oracle Product Lifecycle Analytics accessible data. CVSS 3.1 Base Score 9.0 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability exists within Oracle Product Lifecycle Analytics version 3.6.1, specifically within the installation issues component of Oracle Supply Chain products. The flaw represents a critical security weakness that can be exploited by unauthenticated attackers who already possess legitimate access to the system infrastructure where Oracle Product Lifecycle Analytics operates. This presents a significant risk as it leverages existing system credentials rather than requiring additional authentication mechanisms, making the attack vector particularly dangerous for organizations with compromised or poorly managed access controls.
The technical nature of this vulnerability stems from inadequate security controls during the installation process, creating persistent access points that allow attackers to manipulate the system's core data operations. The CVSS 3.1 base score of 9.0 reflects the high severity impact, with confidentiality and integrity impacts rated as high, indicating that successful exploitation could enable unauthorized modification, deletion, or creation of critical data within the Oracle Product Lifecycle Analytics environment. The attack complexity is low, requiring minimal skill to exploit, while the attack vector is local, meaning only infrastructure access is required rather than network-based penetration.
The operational impact extends beyond just the targeted Oracle Product Lifecycle Analytics system, as indicated by the scope change aspect of this vulnerability. This means that successful exploitation could potentially compromise additional products within the broader Oracle Supply Chain ecosystem, creating cascading security failures that affect multiple interconnected systems. The potential for unauthorized data access and modification represents a severe threat to business continuity and regulatory compliance, particularly given that Oracle Product Lifecycle Analytics typically handles sensitive supply chain and product information.
Organizations should implement immediate mitigations including comprehensive network segmentation to limit local access privileges, enhanced monitoring of system installations and updates, and thorough review of existing access controls for Oracle Product Lifecycle Analytics systems. The vulnerability aligns with CWE-284 (Improper Access Control) and potentially CWE-732 (Incorrect Permission Assignment) categories, while also mapping to ATT&CK techniques involving privilege escalation and persistence mechanisms. Regular security assessments and patch management protocols should be prioritized to address this vulnerability before exploitation becomes widespread, as the low complexity and high impact make it an attractive target for malicious actors seeking to compromise supply chain data integrity.