This vulnerability affects Oracle Product Lifecycle Analytics 3.6.1 and is classified under installation issues. It allows an unauthenticated attacker with network access via HTTP to compromise the product, resulting in unauthorized access to critical data and partial denial of service. The vulnerability has a CVSS 3.1 base score of 9.3, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, scope change, high confidentiality impact, no integrity impact, and low availability impact. The vulnerability may also impact additional Oracle products due to scope change. The vendor advisory from Oracle (July 2026 Critical Patch Update) does not explicitly confirm a patch for this vulnerability but strongly recommends applying available security patches without delay.

Successful exploitation can lead to unauthorized access to all data accessible by Oracle Product Lifecycle Analytics and cause partial denial of service to the product. The confidentiality impact is high, while availability impact is low. Integrity is not impacted. The vulnerability can be exploited remotely without authentication or user interaction, increasing the risk of compromise.

Patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends that customers remain on actively-supported versions and apply security patches promptly. Until a patch is confirmed and applied, restrict network access to Oracle Product Lifecycle Analytics instances and monitor for unusual activity related to this product.