This vulnerability affects Oracle Product Lifecycle Analytics 3.6.1 and arises from an installation issue component. It permits a low privileged attacker with network access over HTTP to compromise the product, leading to unauthorized access to critical data or full access to all accessible data, unauthorized update, insert, or delete operations on some data, and the ability to cause a partial denial of service. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and low availability impact.

Successful exploitation can result in unauthorized access to critical and all accessible data within Oracle Product Lifecycle Analytics, unauthorized modification of some data, and partial denial of service affecting availability. This compromises confidentiality, integrity, and availability of the affected system.

Oracle has released a Critical Security Patch Update advisory including this vulnerability. Customers are strongly advised to apply the relevant security patches promptly. The advisory emphasizes remaining on actively supported versions and applying patches without delay. Patch availability for Oracle Product Lifecycle Analytics 3.6.1 is not explicitly stated in the provided data; therefore, users should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for current patch information and installation instructions.