Executive brief
Oracle Product Lifecycle Analytics is a supply chain management tool used to track and manage product information and lifecycle processes. A vulnerability in the installation component allows authenticated network attackers to completely compromise the application, potentially exposing or manipulating sensitive product and supply chain data.
Technical details
A difficult-to-exploit vulnerability exists in the installation component of Oracle Product Lifecycle Analytics version 3.6.1. The vulnerability requires low-level privileges and network access via HTTP, but no user interaction. Successful exploitation results in complete compromise of the application affecting confidentiality, integrity, and availability. The specific vulnerability class is not detailed in the advisory, but the installation component and authentication requirement suggest a privilege escalation or misconfiguration issue. A patch is likely available through Oracle's standard security update channels.
Affected products
- Oracle Product Lifecycle Analytics 3.6.1
Timeline
- 2026-09-15: disclosed