This vulnerability affects Oracle Product Lifecycle Analytics version 3.6.1 and is exploitable by a high privileged attacker with network access via HTTP. Successful exploitation can result in unauthorized creation, deletion, or modification of critical data, unauthorized access to all accessible data within the product, and the ability to cause a partial denial of service. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts with low availability impact. The vendor advisory does not explicitly confirm the availability of a patch or remediation for this specific vulnerability but references the Oracle Critical Patch Update Advisory for July 2026, which includes numerous patches across Oracle products. No known exploits in the wild have been reported as of the published date.

The impact includes unauthorized creation, deletion, or modification of critical data within Oracle Product Lifecycle Analytics, unauthorized access to all accessible data, and the potential to cause a partial denial of service. This affects confidentiality, integrity, and availability of the affected system. The vulnerability requires high privileges to exploit and network access via HTTP.

Patch status is not yet confirmed — check the Oracle Critical Patch Update Advisory for July 2026 at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches without delay and remaining on actively-supported versions. Since no explicit patch or workaround is stated in the advisory content for this specific vulnerability, monitoring the vendor advisory for updates and applying any relevant patches promptly is advised.