CVE-2026-71049 in Product Lifecycle Analytics
Summary
by MITRE • 08/19/2026
Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: Installation Issues). The supported version that is affected is 3.6.1. Easily exploitable vulnerability allows low privileged attacker with network access via Oracle Net to compromise Oracle Product Lifecycle Analytics. While the vulnerability is in Oracle Product Lifecycle Analytics, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Product Lifecycle Analytics accessible data as well as unauthorized update, insert or delete access to some of Oracle Product Lifecycle Analytics accessible data. CVSS 3.1 Base Score 8.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/19/2026
The identified vulnerability resides within the Oracle Product Lifecycle Analytics component of the Oracle Supply Chain suite, specifically affecting version 3.6.1 and potentially other related products due to a scope change in attack impact. This flaw is categorized as an installation issue that creates a critical security gap by allowing low-privileged attackers with network access via Oracle Net to compromise the system. The vulnerability stems from insufficient validation or configuration checks during the initialization or runtime phases of the application, which permits unauthorized entities to exploit misconfigurations or weak authentication boundaries inherent in the deployment architecture. This type of flaw is commonly associated with CWE-284 Improper Access Control and CWE-798 Use of Hard-coded Credentials if default settings are exploited, reflecting a failure to enforce strict privilege separation during critical operational processes.
The technical nature of this vulnerability allows for exploitation by attackers who do not require high-level privileges or user interaction, as indicated by the low attack complexity and absence of required user interface interactions in the CVSS vector. The presence of network access via Oracle Net suggests that the exploit can be executed remotely over TCP/IP connections without physical proximity to the target system. This remote accessibility significantly expands the attack surface, enabling adversaries located anywhere on a connected network to attempt exploitation. The vulnerability’s design allows for unauthorized access to critical data and complete access to all accessible data within the Product Lifecycle Analytics environment. Furthermore, it permits unauthorized updates, inserts, or deletions of data, thereby compromising both confidentiality and integrity aspects of information security.
The operational impact of this vulnerability is severe due to its potential scope change, meaning that while the flaw originates in Oracle Product Lifecycle Analytics, successful exploitation can lead to broader system compromise affecting additional products within the supply chain ecosystem. This lateral movement capability amplifies the risk profile significantly, as attackers may pivot from a single compromised application to gain deeper access into interconnected enterprise systems. The CVSS 3.1 base score of 8.5 reflects high severity driven primarily by high confidentiality impact and low integrity impact with no availability loss. Attackers can exfiltrate sensitive intellectual property, supply chain data, or customer information stored within the analytics platform. Additionally, they may alter critical records such as production schedules, inventory levels, or financial projections, leading to operational disruptions and potential regulatory non-compliance depending on industry-specific standards like GDPR or SOX.
From a threat intelligence perspective, this vulnerability aligns with ATT&CK techniques related to Initial Access via Valid Accounts if the low-privileged attacker uses stolen credentials, and Lateral Movement through network services. The ability to modify data corresponds to Data Manipulation tactics within the persistence phase of an attack lifecycle. Organizations must treat this as a critical priority for remediation given the high likelihood of exploitation in environments where internal networks are not strictly segmented or where default administrative accounts remain active with weak passwords.
Mitigation strategies should focus on immediate patching to the latest supported version that addresses these installation and access control flaws. In addition to software updates, organizations must enforce strict network segmentation to limit Oracle Net exposure to only authorized subnets. Implementing multi-factor authentication for all user accounts, including low-privileged ones, can reduce the risk of credential-based exploitation. Regular audits of installed components and verification of configuration settings against security baselines are essential to prevent similar installation-related vulnerabilities from persisting in production environments. Monitoring tools should be configured to detect anomalous network traffic patterns consistent with Oracle Net exploitation attempts, ensuring rapid detection and response capabilities are in place before significant data loss or integrity breaches occur.