What is the CVSS score of EUVD-2026-47383?

EUVD-2026-47383 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.4%.

How to fix or mitigate EUVD-2026-47383?

Within 24 hours: Immediately restrict network access to Oracle Product Lifecycle Analytics 3.6.1 to authorized users only through VPN and multi-factor authentication; enable comprehensive access logging and configure alerts on unusual data query patterns. Within 7 days: Conduct full data access audit to identify what information has been exposed through this vulnerability; inventory all downstream systems connected to Analytics 3.6.1 to assess cascade risk; contact Oracle Support to confirm patch availability timeline and request interim mitigation guidance. Within 30 days: Implement web application firewall rules limiting data export endpoints and apply database-level row-level security controls to sensitive supply chain data; establish service monitoring for abnormal access patterns; begin planning migration to patched version immediately upon vendor release or evaluate alternative supply chain analytics platforms if patch is not released within 60 days.

Oracle Product Lifecycle Analytics EUVD-2026-47383

| CVE-2026-61175 CRITICAL

Information Exposure (CWE-200)

2026-07-21 secalert_us@oracle.com

GHSA-4x8j-g4fx-37gq

Authentication Bypass Denial Of Service Information Disclosure Oracle Product Lifecycle Analytics

9.3

CVSS 3.1 · Vendor: oracle

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Reach PLA HTTP interface over network
Delivery

Send crafted unauthenticated request to installation component
Exploit

Bypass authentication
Execution

Read all accessible critical data
Persist

Cross scope to impact adjacent products
Impact

Trigger partial denial of service

Vulnerability Assessment

Weakness	CWE CWE-200 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V14 - Data Protection Data exposure prevention MITRE ATT&CK 2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	No special conditions - remote unauthenticated exploitation over HTTP against Oracle Product Lifecycle Analytics 3.6.1 (CVSS AV:N/AC:L/PR:N/UI:N). The only hard prerequisites are network reachability of the PLA HTTP interface and that the deployed version is 3.6.1. Limiting factors that reduce real-world exposure: the affected surface is the 'Installation Issues' component, so instances that are not internet-facing or that firewall the web tier are substantially harder to reach; the scope-change impact on 'additional products' depends on how tightly PLA is integrated with other Oracle components in the deployment. Impact is confidentiality-heavy with only partial DoS and no integrity effect.
Impact	Signals are strong but partly one-sided. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) describes an easily exploitable, network-reachable, unauthenticated attack requiring no user interaction, with a scope change and high confidentiality impact - a genuine priority-triage candidate at 9.3. However, several real-world de-escalators exist: there is no CISA KEV listing (not confirmed actively exploited), no public POC identified, and no EPSS score was supplied, so exploitation probability cannot be quantified from the input. Integrity impact is None and availability is only Low (partial DoS), so this is primarily a data-disclosure risk rather than full compromise. The dominant risk driver is deployment exposure: internet-facing PLA installs are far higher risk than internal ones. Net: treat as high-priority patching for reachable instances, but note that active-exploitation evidence is absent and EPSS is missing, so urgency rests on CVSS and the unauthenticated network vector rather than confirmed in-the-wild activity.
Exploit ScenarioDerived	An attacker who can reach the PLA web interface over HTTP sends a crafted unauthenticated request to the vulnerable installation/setup-related endpoint, bypassing authentication to read critical product-lifecycle data and, via the scope change, potentially pivot into linked Oracle components. Because attack complexity is Low and no user interaction or credentials are needed, the same request can also be used to induce a partial denial of service. No public POC is identified at time of analysis, so exploitation would currently require original research.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

No patch listed yet 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 22, 2026

Unauthorized critical-data access and partial denial of service in Oracle Product Lifecycle Analytics 3.6.1 (Supply Chain suite, Installation Issues component) allows a remote, unauthenticated attacker over HTTP to fully read all data the application can access and partially disrupt service. The flaw carries a scope change, so successful attacks may significantly impact adjacent Oracle products beyond the analytics component itself. Rated CVSS 3.1 9.3 (Critical); no public exploit identified at time of analysis and it is not listed in CISA KEV.

RemediationAI

Apply the fixes from the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) - Patch available per vendor advisory; Oracle did not publish a discrete fixed build number for PLA 3.6.1 in the supplied data, so obtain the exact patch bundle from that CPU and My Oracle Support. Because the attack is unauthenticated over HTTP with a scope change, prioritize any internet-exposed instance. As compensating controls until patching completes: restrict network access to the PLA HTTP/HTTPS listener to trusted management networks or place it behind a VPN/reverse proxy with authentication (trade-off: breaks direct browser access for remote analysts); block or filter access to installation/setup endpoints of the 'Installation Issues' component at the WAF or web tier (trade-off: may interfere with legitimate reconfiguration); and monitor web logs for unauthenticated requests reaching privileged data paths. Avoid exposing the analytics tier directly to the internet.

Affected VersionsENISA

Oracle Product Lifecycle Analytics 3.6.1

Affected Packages

euvd oracle_product_lifecycle_analytics no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Oracle Product Lifecycle Analytics (PLA) is a business-intelligence application within the Oracle Supply Chain product family that aggregates product/engineering data (e.g., Agile PLM) into analytical dashboards, typically fronted by a Java/OBIEE-style web tier served over HTTP. The affected element is the 'Installation Issues' component, implying the weakness sits in setup/configuration or bootstrap-facing web functionality rather than authenticated business logic. No CWE was assigned by Oracle (CWE: N/A), but the CVSS profile (PR:N, S:C, C:H) combined with the vendor's own 'Authentication Bypass' tag points to a root cause in the authentication/authorization layer that lets an unauthenticated request reach privileged data and cross into other trusted components.

Know when Product Lifecycle Analytics gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (oracle) PRIMARY 9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

vuln.today AI 9.3 CRITICAL

Unauthenticated network HTTP access with low complexity (PR:N/AV:N/AC:L), authentication-bypass to critical data (C:H), scope change to other products (S:C), no integrity change and only partial DoS (I:N/A:L).

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:L/SI:N/SA:L

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

DescriptionCVE.org

Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: Installation Issues). The supported version that is affected is 3.6.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Product Lifecycle Analytics. While the vulnerability is in Oracle Product Lifecycle Analytics, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Product Lifecycle Analytics accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Product Lifecycle Analytics. CVSS 3.1 Base Score 9.3 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L).

Executive ViewAI

Why It Matters

Oracle Product Lifecycle Analytics 3.6.1 contains a critical vulnerability allowing unauthenticated remote attackers to exfiltrate all application data and partially disrupt service, with confirmed risk of cascading impact to adjacent Oracle products in the supply chain suite. This exposure threatens both data confidentiality and operational continuity across supply chain systems with no vendor patch currently available. Immediate network isolation is required to contain risk.

Business Impact: Severe

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: enforce network segmentation isolating Analytics 3.6.1 from production systems; implement API gateway rate-limiting and request throttling to reduce partial DoS risk; deploy Web Application Firewall rules to restrict data access endpoints; enable full request/response logging with SIEM integration and alerting; apply Oracle database-level access controls to enforce least privilege on application accounts; restrict supply chain data export through API authentication and IP whitelisting.

Threat Intelligence Overview

EPSS Score

0.4%

Top 65% exploitable

Prevalence

Low

niche Oracle supply-chain analytics product, limited enterprise footprint

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.4%

Patch available No

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Out-of-Cycle

Exploitation

None

System Exposure· derived

Open

Automatable

Yes

Human Impact

Very High

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +46

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.