What is the CVSS score of CVE-2026-61174?

CVE-2026-61174 has a CVSS 3.1 base score of 9.0 (Critical). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Oracle Product Lifecycle Analytics are affected by CVE-2026-61174?

Oracle Product Lifecycle Analytics 3.6.1 contains a critical local privilege escalation flaw enabling any user with host-level access to fully compromise the application and its data, with potential…

How to fix or mitigate CVE-2026-61174?

Within 24 hours, audit system access logs for suspicious local activity on all Oracle Product Lifecycle Analytics servers and restrict host-level logon access to essential administrators only. Within 7 days, apply the July 2026 Critical Patch Update to all affected Oracle Product Lifecycle Analytics 3.6.1 instances and verify patch installation. Within 30 days, complete a post-patch security review of host access controls, validate application data integrity, and confirm no unauthorized access occurred to other infrastructure systems potentially affected by the scope change.

Oracle Product Lifecycle Analytics CVE-2026-61174

EUVD-2026-47382 CRITICAL

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-xpfj-hffv-j8hr

Authentication Bypass Oracle Product Lifecycle Analytics

9.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.0 CRITICAL

AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

vuln.today AI

9.0 CRITICAL

AV:L reflects required host logon; PR:N per Oracle's authentication-bypass framing (no app credentials); S:C and C:H/I:H match cross-product data compromise with no availability impact.

3.1 AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:20 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

CRITICAL 9.0

DescriptionNVD

Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: Installation Issues). The supported version that is affected is 3.6.1. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Product Lifecycle Analytics executes to compromise Oracle Product Lifecycle Analytics. While the vulnerability is in Oracle Product Lifecycle Analytics, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Product Lifecycle Analytics accessible data as well as unauthorized access to critical data or complete access to all Oracle Product Lifecycle Analytics accessible data. CVSS 3.1 Base Score 9.0 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N).

AnalysisAI

Local privilege-to-scope-change compromise in Oracle Product Lifecycle Analytics 3.6.1 (Oracle Supply Chain, Installation Issues component) lets an attacker with logon access to the host where the software runs take over the application without application-level credentials. Successful exploitation yields full read and write access to all data accessible to Oracle Product Lifecycle Analytics and, because of a CVSS scope change, may significantly impact other products on the same infrastructure. No public exploit identified at time of analysis; the flaw was reported by Oracle and fixed in the July 2026 Critical Patch Update.

Technical ContextAI

Oracle Product Lifecycle Analytics (PLA) is a business-intelligence/analytics application within the Oracle Supply Chain suite that aggregates product lifecycle and PLM data for reporting; it is typically deployed on an application server tier alongside a database and integration components. The vulnerability sits in the 'Installation Issues' component, which points to a weakness in how the product is installed, configured, or provisioned on the host (for example insecure default credentials, world-readable/writable installation artifacts, or a setup routine that exposes privileged functionality to any local account). No CWE was assigned in the input, so the precise weakness class is not confirmed by NVD; Oracle's own tag of 'Authentication Bypass' suggests the root cause allows an attacker to reach privileged application functionality without valid application credentials. The CVSS local attack vector (AV:L) combined with the scope change (S:C) indicates the exploit runs from the underlying infrastructure but the security impact crosses the vulnerable component's authorization boundary into other products.

RemediationAI

Apply the fix delivered in the Oracle July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html), which is the vendor advisory for this CVE - Patch available per vendor advisory; the input does not provide a discrete fixed build number beyond the CPU, so consult the CPU patch matrix for the exact Product Lifecycle Analytics 3.6.1 patch. Because the attack vector is local (AV:L), the most effective compensating control until patching is to tightly restrict interactive and service-account logon to the servers where Oracle Product Lifecycle Analytics executes: limit OS accounts to named administrators, remove shared or default local accounts, and audit who can log on to the infrastructure tier. Given the 'Installation Issues' component, also review and harden the installation's file and directory permissions and any default/setup credentials created during deployment, and monitor the host for unexpected local logons and privilege use. These controls reduce exposure but do not remove the underlying flaw, so they are stopgaps pending the CPU patch.