This vulnerability affects Oracle Product Lifecycle Analytics version 3.6.1 and involves installation issues that can be exploited by a low privileged attacker with network access over HTTP. Successful exploitation can result in complete takeover of the affected product, impacting confidentiality, integrity, and availability. The vulnerability has a CVSS 3.1 base score of 7.5 with vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which includes 673 new security patches across various Oracle products.

If exploited, this vulnerability allows an attacker with low privileges and network access via HTTP to fully compromise Oracle Product Lifecycle Analytics version 3.6.1. This results in complete loss of confidentiality, integrity, and availability of the product, effectively allowing an attacker to take over the system.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability among others. Customers are strongly advised to apply the available security patches without delay and remain on actively supported versions. No specific workaround or temporary fix is mentioned; applying the official patch is the recommended remediation.