Oracle Product Lifecycle Analytics CVE-2026-61174

Exploitation requires local logon access to the infrastructure/host where Oracle Product Lifecycle Analytics 3.6.1 executes (CVSS AV:L) - the attacker does NOT need valid application credentials (Oracle scores PR:N and tags this an authentication bypass), needs no user interaction (UI:N), and faces low attack complexity (AC:L). The specific gated feature is the product's installation/setup configuration ('Installation Issues' component), so a default or as-installed deployment of version 3.6.1 is the exploitable condition. The principal factor LIMITING exploitation is the local attack vector: a remote, network-only attacker with no foothold on the host cannot reach it, so realistic risk is confined to insiders, compromised local/service accounts, or attackers who have already breached the server. Only version 3.6.1 is confirmed affected.

The CVSS 3.1 base score is 9.0 (Critical) driven by AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N - low attack complexity, no privileges or user interaction, high confidentiality and integrity impact, and a scope change, but crucially a LOCAL attack vector. This is materially different from a network-exploitable 9.0: the attacker must already have logon access to the infrastructure where PLA executes, which sharply limits the exploitable population to insiders, compromised service accounts, or attackers who have already gained a foothold on the host. There is no EPSS score, no KEV listing, and no POC in the provided data, so there is no evidence of active or automated exploitation - the risk today is 'high severity if reached, but gated behind local access.' The one internal tension to verify: Oracle labels the attacker 'unauthenticated' (PR:N) yet also requires 'logon to the infrastructure,' which is Oracle's convention for local-but-no-app-credential flaws; defenders should read PR:N here as 'no application authentication needed,' not 'no access needed at all.' Treat this as a real priority for hosts where PLA runs (patch in the July 2026 CPU), but not an internet-facing emergency.

An attacker who has obtained a low-privilege interactive or service-account logon on the server hosting Oracle Product Lifecycle Analytics 3.6.1 - for example a rogue insider or an intruder who compromised another service on the box - leverages the installation weakness to bypass application authentication and act as a privileged PLA user. From there they read, alter, or delete all data accessible to PLA and, thanks to the scope change, pivot to affect other products co-located on the infrastructure. No public exploit is identified at time of analysis, so exploitation would currently require the attacker to develop their own technique.