EUVD-2026-79613
GHSA-x58x-5r3f-gp25
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description confirms unauthenticated network HTTP exploitation (AV:N/AC:L/PR:N/UI:N) resulting in product takeover with full confidentiality, integrity, and availability impact; no scope change indicated.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: Core). The supported version that is affected is 3.6.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Product Lifecycle Analytics. Successful attacks of this vulnerability can result in takeover of Oracle Product Lifecycle Analytics. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
AnalysisAI
Unauthenticated, network-reachable attackers can achieve full takeover of Oracle Product Lifecycle Analytics 3.6.1 through a weakness in the Core component of Oracle Supply Chain, scoring CVSS 3.1 base 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, CWE-287 improper authentication). Exploitation requires no credentials, no user interaction, and no non-default configuration - only that the PLA HTTP interface be reachable from the attacker's network. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions - remote unauthenticated exploitation over HTTP against Oracle Product Lifecycle Analytics 3.6.1 (AV:N/AC:L/PR:N/UI:N), per the CVSS vector and the description's 'easily exploitable...unauthenticated attacker with network access via HTTP.' The primary limiting factor is exposure: the PLA HTTP interface must be reachable by the attacker (typically an internal enterprise deployment rather than internet-facing), and only version 3.6.1 is listed as affected. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority vulnerability by every static signal in the vector: CVSS 3.1 base 9.8 with AV:N/AC:L/PR:N/UI:N and full C:H/I:H/A:H, CWE-287 (authentication bypass/improper authentication) yielding complete product takeover. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No exact fix version is confirmed in the available data, so the first action is to consult Oracle's Security Alert at https://www.oracle.com/security-alerts/cspusep2026.html and apply the Critical Patch Update build specified there for Product Lifecycle Analytics 3.6.1; treat that advisory as the authoritative source rather than any inferred version number. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all instances of Oracle Product Lifecycle Analytics 3.6.1, identify whether the PLA HTTP interface is reachable from untrusted networks, and immediately restrict access via firewall, security group, or network segmentation; if isolation is not possible, take the affected system offline or disable the Core/PLA HTTP service until compensating controls are in place. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today