What is the CVSS score of CVE-2026-61176?

CVE-2026-61176 has a CVSS 3.1 base score of 6.7 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L. EPSS exploitation probability: 0.4%.

Oracle Product Lifecycle Analytics CVE-2026-61176

EUVD-2026-47384 MEDIUM

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-wrmp-38g2-372p

Oracle Denial Of Service Authentication Bypass Privilege Escalation Product Lifecycle Analytics

6.7

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.7 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L

vuln.today AI

6.7 MEDIUM

Consistent with vendor vector; PR:H reflects installation-component access requiring high privilege, with C:H and I:H for full data compromise and A:L for partial DOS.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:18 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: Installation Issues). The supported version that is affected is 3.6.1. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Product Lifecycle Analytics. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Product Lifecycle Analytics accessible data as well as unauthorized access to critical data or complete access to all Oracle Product Lifecycle Analytics accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Product Lifecycle Analytics. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L).

AnalysisAI

Oracle Product Lifecycle Analytics 3.6.1 exposes a network-exploitable flaw in its Installation Issues component, allowing a high-privileged attacker to achieve full confidentiality and integrity compromise of all accessible application data alongside partial service disruption via HTTP. The 'Installation Issues' component designation and the 'Authentication Bypass' intelligence tag together suggest the flaw may reside in insecure post-installation artifacts, exposed setup endpoints, or improperly secured administrative interfaces left accessible after deployment. No public exploit has been identified at time of analysis, and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.

Technical ContextAI

Oracle Product Lifecycle Analytics (OPLA) is part of Oracle's Supply Chain product family, used for analytics across the product lifecycle. The flagged component - 'Installation Issues' - typically denotes vulnerabilities introduced during or persisting after the product's deployment phase, such as residual installation scripts, exposed setup interfaces, default or weak credentials, or administrative endpoints that are not properly secured post-installation. The vulnerability is accessed via HTTP over the network. No CWE identifier was provided in available intelligence data, preventing formal root-cause classification; however, the 'Authentication Bypass' tag in the ENISA EUVD entry suggests a possible access-control or credential-validation failure in the affected component. The CVSS vector (AV:N/AC:L/PR:H/UI:N/S:U) confirms network reachability with low attack complexity and no user interaction, but scopes impact to the OPLA system itself without lateral propagation.

RemediationAI

Apply the patch issued as part of Oracle's Critical Patch Update for July 2026, available via the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html. An exact patched version number was not independently confirmed from available references - consult Oracle's advisory directly to identify the precise fix build. If immediate patching is not possible, conduct an audit of the OPLA 3.6.1 installation to identify and disable or secure any exposed installation-phase endpoints, setup scripts, or residual artifacts that should not be accessible post-deployment; this directly targets the 'Installation Issues' component root cause. Restrict HTTP access to all OPLA administrative and installation-related interfaces to trusted internal IP ranges using firewall or reverse-proxy ACLs - this compensates for network exposure but does not address the underlying flaw. Review and rotate all high-privileged OPLA credentials, particularly any defaults that may have been introduced during installation.