This vulnerability affects Oracle Product Lifecycle Analytics version 3.6.1 and involves installation issues that allow a high privileged attacker with network access via HTTP to compromise the system. Successful exploitation can result in unauthorized creation, deletion, or modification of critical data, unauthorized access to all accessible data, and the ability to cause a partial denial of service. The CVSS 3.1 vector is AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impact with low availability impact. No specific patch or remediation level is stated in the vendor advisory, but Oracle's July 2026 Critical Patch Update advisory should be consulted for patch availability.

The vulnerability allows attackers with high privileges and network access to perform unauthorized creation, deletion, or modification of critical data within Oracle Product Lifecycle Analytics. It also enables unauthorized access to all accessible data and can cause a partial denial of service, impacting confidentiality, integrity, and availability of the system.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches without delay and remaining on actively-supported versions. No specific temporary or official fix is stated in the provided advisory content.