This vulnerability affects Oracle Product Lifecycle Analytics version 3.6.1 and involves a flaw in the Installation Issues component. An attacker with high privileges and network access via Oracle Net can exploit this vulnerability to gain unauthorized access to critical data, including the ability to create, delete, or modify data. The scope of impact may extend beyond Oracle Product Lifecycle Analytics to other Oracle products. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, scope change, and high confidentiality and integrity impacts with no impact on availability.

Exploitation of this vulnerability can result in unauthorized creation, deletion, or modification of critical data within Oracle Product Lifecycle Analytics. The vulnerability also has a scope change, meaning it may impact additional Oracle products beyond the initially affected product. The confidentiality and integrity of data are severely affected, but availability is not impacted.

Oracle has released a Critical Security Patch Update (CSPU) in August 2026 that addresses this vulnerability among others. Customers are strongly advised to apply the available security patches promptly to mitigate this vulnerability. The vendor advisory emphasizes the importance of staying on actively supported versions and applying patches without delay. No indication of temporary fixes or no-action-required status is provided, so patching is the recommended mitigation.