Product Lifecycle Analytics EUVD-2026-105887

Exploitation requires the attacker to already have a local logon account with low privileges (PR:L) on the infrastructure/server where Oracle Product Lifecycle Analytics 3.6.1 executes; the flaw is in the Installation Issues component. There is no remote attack surface (AV:L) and no user interaction is needed (UI:N). Limiting factors that materially reduce real-world risk: the attacker must already possess host-level authenticated access, only version 3.6.1 is listed as affected, and the product is a specialized Oracle Supply Chain back-office application with limited exposure. The exact installation feature or misconfiguration triggering the flaw is not detailed in the available description.

This is a moderate-severity local vulnerability (CVSS 3.1 base 6.1) that should be prioritized well below internet-facing critical flaws. The Oracle-supplied vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L) confirms that exploitation requires local logon access to the infrastructure where Oracle Product Lifecycle Analytics runs (AV:L) plus existing low-level privileges (PR:L) - this is NOT a remotely exploitable or unauthenticated issue despite Oracle's 'easily exploitable' phrasing, which refers to low attack complexity (AC:L) once an attacker already has a foothold. No EPSS score, CISA KEV listing, or public proof-of-concept is present in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' The high confidentiality impact (C:H) means a low-privileged local user could read all PLA-accessible data, while availability impact is only partial (A:L) and there is no integrity impact (I:N). Signals are internally consistent - there is no CVSS-vs-description conflict here - but note the 'Authentication Bypass' input tag contradicts the vector: PR:L indicates authentication is required, not bypassed, so that tag appears mislabeled. Net assessment: a real but second-tier issue whose risk is gated by the need for prior local/authenticated access to a specialized back-office product.

A low-privileged user who already has a logon on the server hosting Oracle Product Lifecycle Analytics 3.6.1 abuses an installation-related weakness to read confidential data across all PLA-accessible records and to partially disrupt the service. Because attack complexity is low (AC:L), the action is reliable once local access exists, but it cannot be performed remotely or by an unauthenticated actor. No public exploit code is identified in the provided intelligence.