EUVD-2026-79613
GHSA-x58x-5r3f-gp25
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed PLA 3.6.1 HTTP endpoint
-
DeliverySend crafted unauthenticated HTTP request
-
ExploitBypass authentication (CWE-287)
-
ExecutionGain full application control
-
ImpactRead/modify/destroy all PLA data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation over HTTP against Oracle Product Lifecycle Analytics 3.6.1 (AV:N/AC:L/PR:N/UI:N), per the CVSS vector and the description's 'easily exploitable...unauthenticated attacker with network access via HTTP.' The primary limiting factor is exposure: the PLA HTTP interface must be reachable by the attacker (typically an internal enterprise deployment rather than internet-facing), and only version 3.6.1 is listed as affected. No user interaction, authentication, or non-default feature toggle is required. Oracle discloses no further preconditions. |
| Impact | This is a genuine high-priority vulnerability by every static signal in the vector: CVSS 3.1 base 9.8 with AV:N/AC:L/PR:N/UI:N and full C:H/I:H/A:H, CWE-287 (authentication bypass/improper authentication) yielding complete product takeover. The description's 'easily exploitable' and 'unauthenticated attacker with network access via HTTP' language is fully consistent with the vector. However, the exploitation signals temper urgency: SSVC records Exploitation=none (no observed exploitation or public PoC), Automatable=yes, and Technical Impact=total - meaning the impact ceiling is maximal and attacks could scale if a working exploit emerges, but none is currently public. Not in CISA KEV, no PoC identified, and no EPSS score is provided, so probability of imminent widespread exploitation cannot be quantified from the data. As with the entire Oracle September 2026 CPU (cspusep2026), Oracle publishes zero technical detail, so the exact bypass mechanism is unknown and severity rests on Oracle's own scoring. Net: treat as a real patch-now priority given pre-auth total-impact takeover and Automatable=yes, but note that absence of PoC/KEV means the near-term threat is potential rather than confirmed active exploitation. No conflicts between the CVSS vector and description were found. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends crafted HTTP request(s) to an internet- or network-reachable Oracle Product Lifecycle Analytics 3.6.1 instance, abusing an improper-authentication flaw (CWE-287) to bypass access controls and gain full control of the application and its data. Because no privileges or user interaction are required and SSVC marks the flaw Automatable=yes, exploitation could be scripted at scale once a technique is known. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Unauthenticated, network-reachable attackers can achieve full takeover of Oracle Product Lifecycle Analytics 3.6.1 through a weakness in the Core component of Oracle Supply Chain, scoring CVSS 3.1 base 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, CWE-287 improper authentication). Exploitation requires no credentials, no user interaction, and no non-default configuration - only that the PLA HTTP interface be reachable from the attacker's network. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records Exploitation: none, though the vulnerability is rated Automatable: yes with Total technical impact, making it a high-priority target for internal enterprise deployments.
RemediationAI
No exact fix version is confirmed in the available data, so the first action is to consult Oracle's Security Alert at https://www.oracle.com/security-alerts/cspusep2026.html and apply the Critical Patch Update build specified there for Product Lifecycle Analytics 3.6.1; treat that advisory as the authoritative source rather than any inferred version number. Until a patch is applied, the most effective compensating control is network-level: restrict access to the PLA HTTP listener so that only trusted management hosts or internal administration subnets can reach it, since the exploit path requires network reachability to the HTTP interface and blocking that reachability removes the attack vector entirely - the trade-off is that legitimate business users of PLA must be routed through an allowed segment or VPN. Additional interim mitigations include placing the PLA endpoint behind an authenticating reverse proxy or WAF with rules to detect anomalous unauthenticated requests to Core component paths, and monitoring application and web logs for authentication-stage anomalies, though these are detective/compensating measures that do not fix the underlying improper-authentication flaw and add latency and maintenance overhead. Because the issue is automation-friendly, prioritize segmentation and exposure reduction for any internet-facing or broadly routable PLA deployment while the vendor patch is validated and rolled out.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-287 (Improper Authentication), indicating that the affected Core component of Oracle Product Lifecycle Analytics fails to correctly verify the identity of a requesting party before granting access to protected functionality. Because the flaw lives in authentication logic that is exposed over HTTP, an attacker who can reach the PLA web endpoint can defeat the authentication boundary without supplying valid credentials, inheriting the full privileges of the compromised application path. Oracle's own advisory text describes the issue as 'easily exploitable' with a network attack vector (AV:N), low attack complexity (AC:L), no privileges required (PR:N), and no user interaction (UI:N); the resulting scope-unchanged but full C:H/I:H/A:H impact means the bypass is sufficient for complete product takeover rather than partial data exposure. Published threat context is consistent across sources - ENISA EUVD-2026-79613 lists only Oracle Product Lifecycle Analytics 3.6.1, the CISA SSVC decision framework scores Automation as 'yes' (suitable for mass scanning or scripting) with Total technical impact while recording no observed exploitation, and no CPE strings or additional component detail were supplied beyond the Oracle Supply Chain Core designation.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description confirms unauthenticated network HTTP exploitation (AV:N/AC:L/PR:N/UI:N) resulting in product takeover with full confidentiality, integrity, and availability impact; no scope change indicated.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: Core). The supported version that is affected is 3.6.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Product Lifecycle Analytics. Successful attacks of this vulnerability can result in takeover of Oracle Product Lifecycle Analytics. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle Product Lifecycle Analytics 3.6.1 running with a network-reachable HTTP interface can be fully taken over by an unauthenticated attacker; no vendor-released patch identified at time of analysis. This creates enterprise risk for supply-chain planning, product lifecycle data, and dependent operations because an intruder could read, alter, or disrupt critical business information without credentials. Leadership should treat any exposed instance as a critical exposure, prioritize immediate isolation or shutdown, and demand a plan for monitoring, containment, and vendor remediation.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting network access to the Oracle Product Lifecycle Analytics 3.6.1 HTTP interface to trusted management networks, blocking internet exposure, segmenting the application from critical data and management networks, monitoring authentication and administrative logs for anomalies, deploying WAF/IPS virtual patching if feasible, and engaging Oracle support for guidance; if exposure cannot be controlled, take the system offline.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB