Oracle PLA EUVD-2026-61997

Exploitation requires an authenticated local OS session on the infrastructure host where Oracle Product Lifecycle Analytics 3.6.1 is installed, with at minimum a low-privileged operating system account (PR:L per CVSS). The 'Installation Issues' component label indicates the vulnerability is rooted in insecure artifacts persisted to disk by the PLA installation routine - such as misconfigured file permissions, overly permissive directories, or accessible credential files - rather than a runtime network-exposed flaw. No network access path exists; the attacker must execute code locally on the host. Factors that limit exploitation: the attack vector is strictly local (AV:L), requiring prior host access via some other means; only version 3.6.1 is confirmed affected; and organizations enforcing strict host isolation, no shared-account policies, and no interactive logon for service accounts will significantly reduce exposure. The scope change means exploitation is not self-contained - additional Oracle or system components accessible from the PLA host are also at risk once PLA is compromised.

The CVSS 3.1 base score of 8.8 (High) is driven primarily by the scope change (S:C) and full C/I/A impact, partially tempered by the local attack vector (AV:L). The local vector is the dominant risk limiter here - this vulnerability is not network-reachable, meaning an attacker must already hold an authenticated OS session on the PLA host. However, low attack complexity (AC:L) and no user interaction (UI:N) mean that once local access is obtained, exploitation is reliable and repeatable without specialized knowledge. EPSS data was not provided, preventing probabilistic exploitation assessment. There is no CISA KEV listing and no publicly known proof-of-concept at time of analysis, both of which reduce immediate real-world urgency. The scope change is the most operationally significant signal: in shared Oracle infrastructure environments - common in large enterprises running multiple Oracle suite components on the same hosts - successful exploitation of PLA could cascade into adjacent Oracle products or OS-level resources. The tag 'Information Disclosure' conflicts with the full C:H/I:H/A:H impact described; this discrepancy should be noted and the vendor advisory consulted for clarification. For organizations with strict host isolation and least-privilege enforcement, real-world risk is substantially lower than the CVSS base score implies.

An attacker who has obtained a low-privileged shell on the Oracle PLA host - through lateral movement from a compromised service account, a phishing payload executed by a local user, or exploitation of a separate vulnerability - identifies world-readable or world-writable files left by the PLA installer, such as a configuration file containing database credentials or a writable startup script. With no complexity barrier and no required user interaction, the attacker reads sensitive credentials to escalate access or overwrites an executable path to inject malicious code into PLA's execution context, achieving full product takeover and pivoting to impact additional Oracle components co-hosted on the same infrastructure. No public exploit code has been identified at time of analysis.