This vulnerability affects Oracle Product Lifecycle Analytics version 3.6.1, specifically in the Installation Issues component. An unauthenticated attacker who has logon access to the infrastructure hosting the product can exploit this flaw to gain unauthorized access, resulting in the ability to create, delete, or modify critical data. The vulnerability's scope extends beyond the product itself, potentially affecting other Oracle products. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N) indicates local attack vector with low attack complexity, no privileges required, no user interaction, scope change, and high confidentiality and integrity impact.

Successful exploitation allows unauthorized creation, deletion, or modification of critical data within Oracle Product Lifecycle Analytics and may lead to unauthorized access to all data accessible by the product. The vulnerability's scope change means it could significantly impact additional Oracle products beyond the initially affected product. The confidentiality and integrity impacts are high, while availability is not affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The Oracle Critical Patch Update Advisory for July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) should be monitored for patch availability and installation instructions. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions to mitigate exploitation risks.