This vulnerability affects Oracle Product Lifecycle Analytics 3.6.1, specifically in the Installation Issues component. An unauthenticated attacker who can log on to the infrastructure where the product runs can exploit this flaw to gain unauthorized access, resulting in the ability to create, delete, or modify critical data within Oracle Product Lifecycle Analytics. The vulnerability has a scope change, meaning it may affect additional Oracle products beyond the immediate target. The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N) indicates local attack vector with low attack complexity, no privileges required, no user interaction, scope changed, and high confidentiality and integrity impacts without availability impact.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Product Lifecycle Analytics and potentially other Oracle products due to scope change. This compromises confidentiality and integrity of data but does not impact availability. The vulnerability is exploitable by unauthenticated attackers who have logon access to the infrastructure, making it a significant risk in environments where such access is possible.

The vendor advisory does not explicitly state the availability of a patch or fix for this vulnerability. Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly when available and remaining on actively supported versions. Until a patch is confirmed, restrict infrastructure logon access to trusted users only to reduce risk.