Product Lifecycle Analytics EUVD-2026-105885

Exploitation requires a pre-existing low-privileged authenticated account (PR:L) on Oracle Product Lifecycle Analytics 3.6.1 and network access to the application, with the attack delivered 'via SQL' against the Installation Issues component. Oracle explicitly rates this 'difficult to exploit' (AC:H), meaning success depends on conditions outside the attacker's direct control that must be met beyond simply holding credentials. Limiting factors that reduce realistic risk: no anonymous/unauthenticated path (credentials are mandatory), high attack complexity, and the scope is unchanged (S:U) so impact is confined to the Product Lifecycle Analytics component itself. Only version 3.6.1 is listed as affected.

This is a moderate-priority vulnerability that should be patched on the normal Oracle CPU cadence rather than treated as an emergency. The CVSS 3.1 base score is 7.5 (High) with vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning network-reachable but with HIGH attack complexity and requiring an already-authenticated low-privileged account (PR:L) - two meaningful friction points that lower real-world exploitability despite the full confidentiality/integrity/availability impact and stated product takeover. No EPSS score, SSVC decision data, POC indicator, or CISA KEV entry was provided in the input, so there is no signal of active or probable exploitation; exploitation status is therefore 'no public exploit identified at time of analysis.' The signals are internally consistent (network vector with authentication and high complexity matches the 'difficult to exploit... low privileged attacker' description), so there is no CVSS-vs-description conflict to flag. Net: a genuinely high-impact-if-exploited flaw, but the AC:H + PR:L gating plus the niche deployment footprint make it a managed-patch priority, not a drop-everything issue.

An attacker who already holds a low-privileged authenticated account on an Oracle Product Lifecycle Analytics 3.6.1 instance reaches it over the network and submits crafted SQL to abuse the vulnerable installation component. After satisfying the specific (high-complexity) conditions needed to trigger the flaw, the attacker escalates to full compromise and takeover of the Product Lifecycle Analytics application. No public proof-of-concept exploit is identified in the provided data.