CVE-2026-61175 in Product Lifecycle Analytics
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: Installation Issues). The supported version that is affected is 3.6.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Product Lifecycle Analytics. While the vulnerability is in Oracle Product Lifecycle Analytics, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Product Lifecycle Analytics accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Product Lifecycle Analytics. CVSS 3.1 Base Score 9.3 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle Product Lifecycle Analytics version 3.6.1, specifically within the installation issues component of Oracle Supply Chain products. The flaw represents a critical security weakness that can be exploited by unauthenticated attackers who gain network access through HTTP protocols. The vulnerability's classification as easily exploitable indicates that sophisticated attack techniques are not required, making it particularly dangerous for organizations that have not implemented proper network segmentation or access controls. The CVSS 3.1 base score of 9.3 reflects the severe impact potential with high confidentiality and availability risks, while the scope change aspect suggests that successful exploitation could extend beyond the targeted product to affect additional systems within the organization's infrastructure.
The technical nature of this vulnerability stems from inadequate authentication mechanisms during the installation process, allowing unauthorized network actors to gain access to sensitive data and system resources without requiring valid credentials. This type of flaw typically falls under CWE-287 which addresses improper authentication issues, and aligns with ATT&CK techniques related to credential harvesting and initial access through network services. The vulnerability's impact extends beyond simple data theft as it can also enable partial denial of service conditions, potentially disrupting business operations and supply chain analytics capabilities that organizations rely upon for decision making.
Organizations utilizing Oracle Product Lifecycle Analytics version 3.6.1 face significant operational risks from this vulnerability, particularly in environments where network access is not properly restricted or monitored. The ability to compromise critical data means that sensitive product lifecycle information, including design specifications, manufacturing details, and supply chain relationships could be exposed to malicious actors. Additionally, the partial denial of service capability can disrupt analytics workflows and potentially impact downstream business processes that depend on accurate product lifecycle data for planning and decision making. The scope change aspect indicates that exploitation might enable attackers to pivot to other systems within the network perimeter, amplifying the overall security impact beyond the directly targeted Oracle product.
Mitigation strategies should focus on immediate patching of affected systems to address the installation issues component vulnerability. Organizations must implement network segmentation controls to limit access to Oracle Product Lifecycle Analytics services and ensure that only authorized personnel can access these systems through secure channels. Additional protective measures include implementing robust monitoring for unusual HTTP traffic patterns, conducting regular vulnerability assessments, and establishing network access controls using firewalls and intrusion detection systems. The security team should also review and strengthen authentication mechanisms for all Oracle products within their environment, as this vulnerability demonstrates the potential for attackers to exploit weak points in installation and access control processes that could lead to broader system compromise.