This vulnerability affects Oracle Product Lifecycle Analytics version 3.6.1 and is easily exploitable by an attacker with low privileges who has logon access to the infrastructure where the product runs. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Product Lifecycle Analytics, as well as unauthorized access to all data accessible by the product. The vulnerability has a CVSS 3.1 score of 8.4 with vector AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N, indicating local attack vector, low attack complexity, low privileges required, no user interaction, scope change, high confidentiality and integrity impact, and no availability impact. The vulnerability may also affect other Oracle products due to scope change.

An attacker with low privileges and logon access to the infrastructure can compromise Oracle Product Lifecycle Analytics 3.6.1, resulting in unauthorized creation, deletion, or modification of critical data. This can lead to full unauthorized access to all data accessible by the product. The vulnerability also has the potential to impact additional Oracle products beyond Oracle Product Lifecycle Analytics due to scope change.

Oracle has released security patches as part of its September 2026 Critical Security Patch Update (CSPU). Customers are strongly advised to apply the available patches without delay to remediate this vulnerability. The vendor advisory emphasizes remaining on actively supported versions and promptly applying security patches. Patch status is confirmed as available via the Oracle CSPU advisory. No alternative mitigations or workarounds are specified.