Oracle Product Lifecycle Analytics EUVD-2026-47384

Exploitation requires network-level HTTP access to an Oracle Product Lifecycle Analytics 3.6.1 instance and, per the CVSS vector (PR:H), a high-privileged account. The 'Installation Issues' component label indicates the vulnerable surface is likely associated with installation-phase interfaces, setup scripts, or administrative endpoints that persist post-deployment - organizations where these surfaces remain network-accessible face elevated risk. A critical unresolved tension exists: the 'Authentication Bypass' intelligence tag suggests authentication may be circumventable, which would reduce the effective exploitation requirement below PR:H; this must be confirmed via Oracle's full advisory. Exploitation is not constrained by attack complexity (AC:L) or user interaction (UI:N). Scope is unchanged (S:U), limiting impact to the OPLA system. Limiting factors include the PR:H requirement if no bypass exists, and the requirement for the OPLA installation to be reachable over HTTP from the attacker's network position.

The vendor-assigned CVSS 3.1 base score of 6.7 reflects a network-reachable vulnerability with high confidentiality and integrity impact, moderated by the PR:H (high privilege) requirement. In isolation, PR:H significantly limits the exploitable population. However, the 'Authentication Bypass' tag in the ENISA EUVD intelligence data directly conflicts with the PR:H CVSS metric: if an authentication bypass is genuinely present, the effective privilege bar could be substantially lower, making the real-world risk meaningfully higher than the 6.7 score implies - this discrepancy must be verified against the full Oracle CPU July 2026 advisory text. No EPSS score was provided, and this CVE does not appear in CISA KEV, indicating no confirmed active exploitation. Attack complexity is low (AC:L) and no user interaction is required, meaning exploitation is straightforward once the privilege condition is met or bypassed. The partial availability impact (A:L) limits denial-of-service concern, but C:H and I:H together represent complete data exposure and modification risk for the OPLA application. Priority should be elevated for organizations with internet-exposed OPLA installations or those that have not audited post-installation artifacts.

An attacker with high-privileged credentials - or one leveraging a potential authentication bypass suggested by intelligence tags - sends crafted HTTP requests targeting the Oracle Product Lifecycle Analytics 3.6.1 installation component, which may expose residual setup interfaces or insecurely configured endpoints. Successfully exploiting the flaw grants the attacker the ability to read or modify all data accessible within the OPLA application and cause partial service disruption. No public proof-of-concept code has been identified at time of analysis.