Product Lifecycle Analytics CVE-2026-71048

Exploitation requires a valid low-privileged account on the Oracle Product Lifecycle Analytics 3.6.1 installation and network access via HTTP. The vulnerable component is specifically tied to 'Installation Issues,' meaning the attack surface is likely a misconfiguration, residual endpoint, or insecure file introduced during the installation process - this condition is present in a standard installation of version 3.6.1 and may not require any non-default configuration by the administrator. Exploitation is limited by the requirement for at least a low-privileged credential (PR:L per CVSS); however, the 'Authentication Bypass' tag from EUVD introduces uncertainty about whether this credential requirement can itself be bypassed. No user interaction is required (UI:N), and no elevated privileges beyond a basic account are confirmed as necessary.

The CVSS 3.1 score of 7.6 is well-supported by the vector: network-accessible (AV:N), low complexity (AC:L), low privilege (PR:L), no user interaction (UI:N), with high confidentiality and limited integrity and availability impact. The primary driver of risk is the C:H rating - complete read access to all PLA-accessible data - which is significant for an application managing sensitive supply chain and product data. The 'Authentication Bypass' tag in EUVD creates a minor conflict with the PR:L CVSS assignment: if authentication can be bypassed entirely, the effective privilege requirement may be lower than stated - this discrepancy should be verified against the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html. No EPSS score was provided in the input data, so exploitation probability cannot be quantified. No CISA KEV listing and no public POC have been identified, reducing near-term exploitation urgency; however, the low attack complexity means that once a method is discovered, exploitation would be straightforward - even a modest enterprise operating Oracle Supply Chain tooling should treat this as a priority patch during the next maintenance window.

An attacker with a low-privileged account on the Oracle PLA instance sends crafted HTTP requests targeting an installation-related component - potentially an improperly secured endpoint or file left exposed after installation - to read the full dataset accessible to the application, including sensitive supply chain and product lifecycle records. No public proof-of-concept code has been identified, but the low attack complexity (AC:L) means exploitation would be straightforward once the specific installation artifact is identified.