CVE-2026-71051 is a vulnerability in Oracle Product Lifecycle Analytics (component: Installation Issues) version 3.6.1. It is easily exploitable by an attacker with low privileges who has logon access to the infrastructure where the product runs. Successful exploitation can lead to complete compromise of Oracle Product Lifecycle Analytics, with high impact on confidentiality, integrity, and availability. The vulnerability also has a scope change effect, potentially impacting other Oracle products. The CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, indicating local attack vector, low attack complexity, low privileges required, no user interaction, scope changed, and high impact on confidentiality, integrity, and availability. Oracle's August 2026 Critical Security Patch Update advisory references this vulnerability but does not provide a direct patch link for version 3.6.1.

An attacker with low privileges and logon access to the infrastructure can exploit this vulnerability to take over Oracle Product Lifecycle Analytics version 3.6.1. This results in complete compromise affecting confidentiality, integrity, and availability of the product. Due to scope change, other Oracle products may also be significantly impacted. The CVSS score of 8.8 reflects a high severity threat.

Oracle recommends applying security patches promptly as part of their Critical Security Patch Update program. Customers should remain on actively-supported versions and apply available patches without delay. However, no explicit patch for Oracle Product Lifecycle Analytics version 3.6.1 is provided in the advisory content. Patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for current remediation guidance.