Product Lifecycle Analytics CVE-2026-71050

Exploitation requires network access via the Oracle Net protocol to an instance of Oracle Product Lifecycle Analytics version 3.6.1. The CVSS vector specifies PR:H, meaning a high-privileged account is required; however, the vendor-supplied 'Authentication Bypass' tag suggests the actual authentication barrier may be weaker than PR:H implies - this conflict is unresolved from available data. The vulnerable component is specifically the Installation Issues subsystem, suggesting the attack surface is present only on instances where installation artifacts or components remain exposed post-deployment. No user interaction is required. The scope change condition means additional Oracle products co-located in the same environment can be impacted beyond OPLA itself. Exploitation is limited by: the PR:H privilege requirement (or equivalent bypass), the need for Oracle Net reachability, and the specific affected version (3.6.1 only).

The CVSS 3.1 base score of 8.7 is substantiated by a network-reachable attack vector (AV:N), low complexity (AC:L), no user interaction (UI:N), and high confidentiality and integrity impacts - but it is tempered by the PR:H requirement, meaning exploitation nominally demands a highly privileged account. However, the vendor-supplied 'Authentication Bypass' tag creates a meaningful tension with PR:H: if an authentication bypass is the actual mechanism, the effective privilege bar may be lower than the CVSS metric implies, and this discrepancy should be verified against the full Oracle CPU advisory. No EPSS data was provided, and the vulnerability does not appear in the CISA KEV catalog, indicating no confirmed in-the-wild exploitation at time of analysis. The scope change is the most consequential signal: in a shared Oracle environment, post-exploitation lateral movement into adjacent products is a realistic concern, meaning even a mid-sized municipal IT team in kielce running an integrated Oracle Supply Chain stack should treat this as urgent patch work rather than a routine cycle item. Real-world risk is moderate-to-high for multi-product Oracle deployments but lower for isolated OPLA instances given the PR:H prerequisite.

An attacker with high-privileged access to the network-facing Oracle Net interface - for example, a compromised Oracle DBA account or an insider with administrative credentials - sends a crafted Oracle Net request targeting the OPLA Installation Issues component. Exploitation succeeds without any victim interaction and results in full read and write access to OPLA data, with the scope change enabling lateral movement into co-hosted Oracle products. No public proof-of-concept code has been identified at time of analysis.