CVE-2026-83264 is a vulnerability in Oracle Product Lifecycle Analytics (version 3.6.1) that can be exploited by a low privileged attacker with logon access to the infrastructure where the product runs. The vulnerability affects installation components and allows unauthorized creation, deletion, or modification of critical data, resulting in a confidentiality and integrity impact. The CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N, indicating local attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high confidentiality and integrity impact without availability impact. Oracle's September 2026 Critical Security Patch Update includes patches for this vulnerability among 673 others across multiple products.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Product Lifecycle Analytics, compromising confidentiality and integrity of all accessible data. The vulnerability has a high severity with a CVSS score of 8.4. The scope change indicates that the impact may extend beyond the immediate product to additional Oracle products. There is no indication of availability impact or known exploits in the wild at this time.

Oracle has released security patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches promptly to mitigate the risk. Staying on actively supported versions and applying Oracle's security patches without delay is recommended. No alternative mitigations or temporary fixes are indicated in the advisory.