CVE-2026-71050 in Product Lifecycle Analytics
Summary
by MITRE • 08/19/2026
Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: Installation Issues). The supported version that is affected is 3.6.1. Easily exploitable vulnerability allows high privileged attacker with network access via Oracle Net to compromise Oracle Product Lifecycle Analytics. While the vulnerability is in Oracle Product Lifecycle Analytics, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Product Lifecycle Analytics accessible data as well as unauthorized access to critical data or complete access to all Oracle Product Lifecycle Analytics accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/19/2026
The identified vulnerability resides within the Oracle Product Lifecycle Analytics component of the broader Oracle Supply Chain suite, specifically affecting version 3.6.1 and potentially other related products due to scope changes in attack impact. This flaw is categorized under installation issues, indicating that the root cause likely stems from improper configuration or privilege management during the deployment or initialization phases of the software rather than a logic error within the core application code itself. The vulnerability presents an easily exploitable risk for attackers who possess high-level privileges and have network access via Oracle Net to the affected system. This combination of factors suggests that while initial authentication is required, the barrier to exploitation is low once those credentials are obtained or if privilege escalation has already occurred through other means within the environment.
From a technical perspective, the flaw allows for unauthorized creation, deletion, or modification of critical data as well as complete access to all Oracle Product Lifecycle Analytics accessible data. This indicates that the vulnerability likely involves improper enforcement of security controls during installation processes, such as weak default permissions, insecure file system attributes, or misconfigured database schemas that persist after setup is complete. The ability to modify and delete critical data points directly to integrity violations, while the capability to access all sensitive information highlights severe confidentiality breaches. Because attacks may significantly impact additional products beyond just Product Lifecycle Analytics, this represents a lateral movement risk where compromising one component can lead to the compromise of interconnected systems within the Oracle Supply Chain ecosystem.
The operational impact of this vulnerability is substantial, with a CVSS 3.1 Base Score of 8.7 classified as High severity. The vector string (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N) reveals that the attack requires network access and low complexity but demands high privileges, which aligns with its classification as an installation-related issue often exploitable by insider threats or compromised administrative accounts. The scope change from C to S indicates that a vulnerability in this component can affect resources beyond its own security boundary, potentially compromising other Oracle products sharing underlying infrastructure or data stores. The impacts on confidentiality and integrity are both rated as High, meaning successful exploitation leads to total loss of sensitive information and complete alteration of system state without necessarily disrupting availability, although the deletion of critical data could indirectly cause service disruptions.
In terms of industry standards mapping, this vulnerability aligns with CWE-250, which covers execution with unnecessary privileges, often resulting from improper installation or configuration practices that grant excessive permissions to services or users. It also relates closely to CWE-732, involving incorrect permission assignment for Critical Database Objects, particularly if the issue stems from default configurations during setup. From an offensive security perspective, this falls under MITRE ATT&CK technique T1098, specifically SSH Authorized Keys Manipulation or similar account manipulation tactics where attackers leverage existing high-level access to establish persistence or escalate privileges further by modifying system files or database records that control authentication and authorization mechanisms.
Mitigation strategies must focus on rigorous hardening of the installation process for Oracle Product Lifecycle Analytics version 3.6.1. Administrators should ensure that all default accounts are disabled or have their passwords changed immediately upon deployment, adhering to the principle of least privilege by restricting access to critical data only to those users who strictly require it. Regular audits of file system permissions and database object privileges are essential to detect any deviations from secure baselines. Furthermore, since this vulnerability impacts additional products due to scope changes, a holistic review of the entire Oracle Supply Chain environment is recommended to identify shared vulnerabilities or misconfigurations that could be exploited in conjunction with this flaw. Network segmentation should also be enforced to limit Oracle Net access to only authorized administrative workstations, reducing the attack surface for high-privileged attackers attempting remote exploitation.