What is the CVSS score of CVE-2026-61175?

CVE-2026-61175 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.4%.

Which versions of Oracle Product Lifecycle Analytics are affected by CVE-2026-61175?

Oracle Product Lifecycle Analytics 3.6.1 contains a critical vulnerability allowing unauthenticated remote attackers to exfiltrate all application data and partially disrupt service, with confirmed…

How to fix or mitigate CVE-2026-61175?

Within 24 hours: Immediately restrict network access to Oracle Product Lifecycle Analytics 3.6.1 to authorized users only through VPN and multi-factor authentication; enable comprehensive access logging and configure alerts on unusual data query patterns. Within 7 days: Conduct full data access audit to identify what information has been exposed through this vulnerability; inventory all downstream systems connected to Analytics 3.6.1 to assess cascade risk; contact Oracle Support to confirm patch availability timeline and request interim mitigation guidance. Within 30 days: Implement web application firewall rules limiting data export endpoints and apply database-level row-level security controls to sensitive supply chain data; establish service monitoring for abnormal access patterns; begin planning migration to patched version immediately upon vendor release or evaluate alternative supply chain analytics platforms if patch is not released within 60 days.

Oracle Product Lifecycle Analytics CVE-2026-61175

EUVD-2026-47383 CRITICAL

Information Exposure (CWE-200)

2026-07-21 secalert_us@oracle.com

GHSA-4x8j-g4fx-37gq

Denial Of Service Authentication Bypass Oracle Information Disclosure Product Lifecycle Analytics

9.3

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

9.3 CRITICAL

Unauthenticated network HTTP access with low complexity (PR:N/AV:N/AC:L), authentication-bypass to critical data (C:H), scope change to other products (S:C), no integrity change and only partial DoS (I:N/A:L).

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:L/SI:N/SA:L

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:20 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

CRITICAL 9.3

DescriptionCVE.org

Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: Installation Issues). The supported version that is affected is 3.6.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Product Lifecycle Analytics. While the vulnerability is in Oracle Product Lifecycle Analytics, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Product Lifecycle Analytics accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Product Lifecycle Analytics. CVSS 3.1 Base Score 9.3 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L).

AnalysisAI

Unauthorized critical-data access and partial denial of service in Oracle Product Lifecycle Analytics 3.6.1 (Supply Chain suite, Installation Issues component) allows a remote, unauthenticated attacker over HTTP to fully read all data the application can access and partially disrupt service. The flaw carries a scope change, so successful attacks may significantly impact adjacent Oracle products beyond the analytics component itself. Rated CVSS 3.1 9.3 (Critical); no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Oracle Product Lifecycle Analytics (PLA) is a business-intelligence application within the Oracle Supply Chain product family that aggregates product/engineering data (e.g., Agile PLM) into analytical dashboards, typically fronted by a Java/OBIEE-style web tier served over HTTP. The affected element is the 'Installation Issues' component, implying the weakness sits in setup/configuration or bootstrap-facing web functionality rather than authenticated business logic. No CWE was assigned by Oracle (CWE: N/A), but the CVSS profile (PR:N, S:C, C:H) combined with the vendor's own 'Authentication Bypass' tag points to a root cause in the authentication/authorization layer that lets an unauthenticated request reach privileged data and cross into other trusted components.

RemediationAI

Apply the fixes from the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) - Patch available per vendor advisory; Oracle did not publish a discrete fixed build number for PLA 3.6.1 in the supplied data, so obtain the exact patch bundle from that CPU and My Oracle Support. Because the attack is unauthenticated over HTTP with a scope change, prioritize any internet-exposed instance. As compensating controls until patching completes: restrict network access to the PLA HTTP/HTTPS listener to trusted management networks or place it behind a VPN/reverse proxy with authentication (trade-off: breaks direct browser access for remote analysts); block or filter access to installation/setup endpoints of the 'Installation Issues' component at the WAF or web tier (trade-off: may interfere with legitimate reconfiguration); and monitor web logs for unauthenticated requests reaching privileged data paths. Avoid exposing the analytics tier directly to the internet.