Product Lifecycle Analytics CVE-2026-71049

Exploitation requires possession of at least a low-privileged account on Oracle Product Lifecycle Analytics 3.6.1 and network-level access to the Oracle Net service endpoint. The vulnerable condition exists in standard installations of version 3.6.1 - the Oracle advisory designates the component as 'Installation Issues,' indicating the flaw is present in the default installed state without requiring any special non-default configuration by the victim organization. No user interaction is needed once the attacker has credentials and network connectivity. Exploitation is constrained to environments running exactly version 3.6.1 of Oracle PLA, as no other versions are confirmed affected. The primary limiting factor is the low-privilege credential requirement: mass unauthenticated internet exploitation is not possible, but the threat is realistic from insiders, compromised user accounts, or attackers who have obtained PLA credentials through prior phishing or credential reuse. The scope change impact on additional Oracle products depends on the specific Oracle environment topology - not all deployments will have adjacent Oracle products reachable via the same Oracle Net tier.

The risk profile here is meaningfully elevated beyond a theoretical CVSS score. The AV:N/AC:L/PR:L/UI:N combination means any attacker holding even the most basic PLA account credentials and network reachability to the Oracle Net port can exploit this without any additional complexity or social engineering of other users. The 'easily exploitable' qualifier in Oracle's official advisory reinforces the AC:L assessment. The scope change (S:C) is the most operationally significant factor: in enterprise deployments where Oracle Supply Chain, Oracle Database, and adjacent Oracle middleware share infrastructure, a breach of PLA can be a pivot point into broader Oracle estate data. The high confidentiality impact (C:H) means the attacker likely gains access to complete PLA data - product designs, supplier data, cost structures, lifecycle records. Integrity impact is partial (I:L), limiting but not eliminating modification risk. No EPSS score was available in the source data, preventing quantitative exploitation probability comparison. The absence from CISA KEV and lack of known public exploit code reduces urgency modestly, but Oracle's 'easily exploitable' language and the low barrier (PR:L, AC:L) mean exploitation is achievable by a moderately skilled insider or attacker with prior credential access. This is a real remediation priority for Oracle Supply Chain users, not a high-CVSS-but-low-real-risk scenario.

An attacker with a low-privileged PLA account - obtained via credential stuffing against a weak installation-default password, phishing, or insider access - connects to the Oracle Net endpoint of PLA 3.6.1 and triggers the installation-component authorization bypass to read complete supply chain records such as product designs, supplier pricing, and BOM cost data that should be restricted to higher-privilege roles. With scope change in effect, the attacker may subsequently access additional Oracle resources connected via the same Oracle Net fabric, broadening the impact beyond the PLA application boundary. No public exploit code has been identified at time of analysis.