Oracle Product Lifecycle Analytics CVE-2026-61175

No special conditions - remote unauthenticated exploitation over HTTP against Oracle Product Lifecycle Analytics 3.6.1 (CVSS AV:N/AC:L/PR:N/UI:N). The only hard prerequisites are network reachability of the PLA HTTP interface and that the deployed version is 3.6.1. Limiting factors that reduce real-world exposure: the affected surface is the 'Installation Issues' component, so instances that are not internet-facing or that firewall the web tier are substantially harder to reach; the scope-change impact on 'additional products' depends on how tightly PLA is integrated with other Oracle components in the deployment. Impact is confidentiality-heavy with only partial DoS and no integrity effect.

Signals are strong but partly one-sided. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) describes an easily exploitable, network-reachable, unauthenticated attack requiring no user interaction, with a scope change and high confidentiality impact - a genuine priority-triage candidate at 9.3. However, several real-world de-escalators exist: there is no CISA KEV listing (not confirmed actively exploited), no public POC identified, and no EPSS score was supplied, so exploitation probability cannot be quantified from the input. Integrity impact is None and availability is only Low (partial DoS), so this is primarily a data-disclosure risk rather than full compromise. The dominant risk driver is deployment exposure: internet-facing PLA installs are far higher risk than internal ones. Net: treat as high-priority patching for reachable instances, but note that active-exploitation evidence is absent and EPSS is missing, so urgency rests on CVSS and the unauthenticated network vector rather than confirmed in-the-wild activity.

An attacker who can reach the PLA web interface over HTTP sends a crafted unauthenticated request to the vulnerable installation/setup-related endpoint, bypassing authentication to read critical product-lifecycle data and, via the scope change, potentially pivot into linked Oracle components. Because attack complexity is Low and no user interaction or credentials are needed, the same request can also be used to induce a partial denial of service. No public POC is identified at time of analysis, so exploitation would currently require original research.