Product Lifecycle Analytics EUVD-2026-105886

Exploitation requires interactive logon to the infrastructure where Oracle Product Lifecycle Analytics 3.6.1 executes (AV:L) AND pre-existing HIGH privileges on that host (PR:H); the flaw resides in the Installation Issues component. No user interaction is required (UI:N) and attack complexity is low (AC:L) once positioned. Limiting factors: the attacker must already be a privileged local operator, so remote and unauthenticated exploitation is not possible; only version 3.6.1 is listed as affected, and availability is unaffected (A:N).

This is a moderate-severity, low-urgency issue despite the HIGH confidentiality and integrity impacts. The Oracle-assigned CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N, base 6.0) is the limiting factor: exploitation requires LOCAL access (AV:L) to the infrastructure where Oracle Product Lifecycle Analytics runs AND already-HIGH privileges (PR:H). An attacker must therefore already be a privileged operator on the host, which sharply narrows the realistic threat to insiders or an attacker who has already achieved privileged foothold via another vector. No EPSS score, no POC, and no CISA KEV entry were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The description's phrase 'Easily exploitable' corresponds only to AC:L (low attack complexity) once the attacker is already positioned - it does NOT lower the local-access and high-privilege prerequisites. One signal conflict to note: the input Tags include 'Authentication Bypass,' which contradicts the PR:H vector - a true authentication bypass would imply PR:N, so this tag appears mislabeled and should not drive prioritization. Net: a legitimate patch-cycle item (Oracle October 2026 CPU), not an emergency; the high impact scores are gated behind substantial access prerequisites.

An attacker who already holds high-privilege credentials and interactive logon on the server hosting Oracle Product Lifecycle Analytics 3.6.1 abuses an installation-component flaw to read, modify, or delete all data accessible to the application. No user interaction is needed, but the attacker must already be a privileged local user - making this primarily an insider or post-compromise escalation scenario. No public proof-of-concept was identified at time of analysis.