CVE-2026-71048
HighCVSS 7.6Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
Vulnerability in Oracle Product Lifecycle Analytics (component: Installation Issues) affects version 3.6.1. A low-privileged attacker can via HTTP gain unauthorized access to critical data, modify some data, and cause a partial denial of service. CVSS 7.6.
Risk Assessment
Risk includes confidentiality, integrity, and availability breaches, potentially affecting system operation.
Recommendation
Apply vendor patches for version 3.6.1 and restrict HTTP access to trusted users.
Original NVD description (English source)
Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: Installation Issues). The supported version that is affected is 3.6.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Lifecycle Analytics. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Product Lifecycle Analytics accessible data as well as unauthorized update, insert or delete access to some of Oracle Product Lifecycle Analytics accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Product Lifecycle Analytics. CVSS 3.1 Base Score 7.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L).