Product Lifecycle Analytics EUVD-2026-105888

Exploitation requires the attacker to already possess a low-privileged account with interactive logon access to the infrastructure/host where Oracle Product Lifecycle Analytics 3.6.1 executes (AV:L, PR:L); the flaw resides in the product's Installation Issues component. No user interaction is required (UI:N) and attack complexity is low (AC:L). The key limiting factors are the mandatory local host access and valid local credentials - there is no remote network path - which confines the threat to insiders or attackers who have already gained a foothold on the server. Only confidentiality is affected; no data modification or service disruption is possible.

This is a moderate-severity, context-dependent risk rather than an urgent priority. The CVSS 3.1 base score is 5.5 with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, meaning exploitation requires LOCAL access (AV:L) and an existing low-privileged account with logon rights to the host where Oracle Product Lifecycle Analytics runs (PR:L). Impact is confined to confidentiality (C:H, I:N, A:N) - an attacker can read all data accessible to the product but cannot modify data or disrupt availability. No EPSS score, CISA KEV listing, or public POC was provided in the input, and there is no public exploit identified at time of analysis, so there is no signal of active or probable widespread exploitation. The local attack vector plus required authentication substantially limits real-world risk compared to a network-facing flaw, so this ranks as routine-patch priority. Note a conflict in the metadata: the CVE is tagged 'Authentication Bypass,' but the description and CVSS vector describe a LOCAL privilege-requiring (PR:L) confidentiality disclosure with no integrity impact - this is not an authentication bypass, and the tag should be verified against Oracle's advisory.

An attacker who already holds a low-privileged local account on the server hosting Oracle Product Lifecycle Analytics 3.6.1 leverages the installation-component flaw to read sensitive data they should not be able to access, up to all data the application can reach. No user interaction is needed and attack complexity is low, but local logon access is a prerequisite. No public exploit code is known at time of analysis.