Product Lifecycle Analytics
Monthly
Local privilege escalation in Oracle Product Lifecycle Analytics 3.6.1 enables a low-privileged attacker with host-level logon access to fully compromise the platform, achieving complete confidentiality, integrity, and availability takeover. The vulnerable component is labeled 'Installation Issues,' indicating the flaw stems from insecure artifacts - such as file permissions, directory ownership, or credential files - left accessible by the installer. Critically, the CVSS scope change (S:C) confirms that a successful attack can significantly impact additional co-hosted Oracle or system components beyond PLA itself; no public exploit or CISA KEV listing has been identified at time of analysis.
High-privileged network exploitation of Oracle Product Lifecycle Analytics 3.6.1 enables complete unauthorized read and write access to critical data, with a confirmed scope change that can cascade into compromise of additional Oracle products sharing the same environment. The vulnerable component is tied to Installation Issues within Oracle's Supply Chain suite, reachable over Oracle Net without user interaction. No public exploit code has been identified at time of analysis, but the CVSS 8.7 rating and scope-change designation make this a serious priority for organizations running OPLA in multi-product Oracle estates.
Oracle Product Lifecycle Analytics 3.6.1 exposes a network-accessible, low-complexity authorization flaw in its Installation Issues component, tagged as an Authentication Bypass, enabling low-privileged authenticated users to gain unauthorized read access to critical supply chain data and perform limited unauthorized data modifications. The scope change designation (S:C) means successful exploitation can cascade to impact additional Oracle products sharing the same environment - a significant compounding risk in multi-product Oracle deployments. No public exploit code has been identified at time of analysis, and this vulnerability is not currently listed in the CISA KEV catalog, though Oracle's own advisory characterizes it as 'easily exploitable' with a CVSS 8.5 base score.
Oracle Product Lifecycle Analytics 3.6.1 exposes a network-accessible vulnerability in its installation component that allows low-privileged authenticated attackers to fully read all application data, perform limited data modification, and cause partial service disruption via HTTP. The CVSS 3.1 score of 7.6 reflects meaningful real-world impact, particularly the high confidentiality impact against a supply chain analytics platform that may contain sensitive product and operational data. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Unauthorized critical-data access and partial denial of service in Oracle Product Lifecycle Analytics 3.6.1 (Supply Chain suite, Installation Issues component) allows a remote, unauthenticated attacker over HTTP to fully read all data the application can access and partially disrupt service. The flaw carries a scope change, so successful attacks may significantly impact adjacent Oracle products beyond the analytics component itself. Rated CVSS 3.1 9.3 (Critical); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local privilege-to-scope-change compromise in Oracle Product Lifecycle Analytics 3.6.1 (Oracle Supply Chain, Installation Issues component) lets an attacker with logon access to the host where the software runs take over the application without application-level credentials. Successful exploitation yields full read and write access to all data accessible to Oracle Product Lifecycle Analytics and, because of a CVSS scope change, may significantly impact other products on the same infrastructure. No public exploit identified at time of analysis; the flaw was reported by Oracle and fixed in the July 2026 Critical Patch Update.
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Oracle Product Lifecycle Analytics 3.6.1 exposes a network-exploitable flaw in its Installation Issues component, allowing a high-privileged attacker to achieve full confidentiality and integrity compromise of all accessible application data alongside partial service disruption via HTTP. The 'Installation Issues' component designation and the 'Authentication Bypass' intelligence tag together suggest the flaw may reside in insecure post-installation artifacts, exposed setup endpoints, or improperly secured administrative interfaces left accessible after deployment. No public exploit has been identified at time of analysis, and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.
Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has...
Vulnerability in the Advanced Networking Option component of Oracle Database Server. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to allocate large amounts of memory that leads to an out of memory error, even for small inputs. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity.
Local privilege escalation in Oracle Product Lifecycle Analytics 3.6.1 enables a low-privileged attacker with host-level logon access to fully compromise the platform, achieving complete confidentiality, integrity, and availability takeover. The vulnerable component is labeled 'Installation Issues,' indicating the flaw stems from insecure artifacts - such as file permissions, directory ownership, or credential files - left accessible by the installer. Critically, the CVSS scope change (S:C) confirms that a successful attack can significantly impact additional co-hosted Oracle or system components beyond PLA itself; no public exploit or CISA KEV listing has been identified at time of analysis.
High-privileged network exploitation of Oracle Product Lifecycle Analytics 3.6.1 enables complete unauthorized read and write access to critical data, with a confirmed scope change that can cascade into compromise of additional Oracle products sharing the same environment. The vulnerable component is tied to Installation Issues within Oracle's Supply Chain suite, reachable over Oracle Net without user interaction. No public exploit code has been identified at time of analysis, but the CVSS 8.7 rating and scope-change designation make this a serious priority for organizations running OPLA in multi-product Oracle estates.
Oracle Product Lifecycle Analytics 3.6.1 exposes a network-accessible, low-complexity authorization flaw in its Installation Issues component, tagged as an Authentication Bypass, enabling low-privileged authenticated users to gain unauthorized read access to critical supply chain data and perform limited unauthorized data modifications. The scope change designation (S:C) means successful exploitation can cascade to impact additional Oracle products sharing the same environment - a significant compounding risk in multi-product Oracle deployments. No public exploit code has been identified at time of analysis, and this vulnerability is not currently listed in the CISA KEV catalog, though Oracle's own advisory characterizes it as 'easily exploitable' with a CVSS 8.5 base score.
Oracle Product Lifecycle Analytics 3.6.1 exposes a network-accessible vulnerability in its installation component that allows low-privileged authenticated attackers to fully read all application data, perform limited data modification, and cause partial service disruption via HTTP. The CVSS 3.1 score of 7.6 reflects meaningful real-world impact, particularly the high confidentiality impact against a supply chain analytics platform that may contain sensitive product and operational data. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Unauthorized critical-data access and partial denial of service in Oracle Product Lifecycle Analytics 3.6.1 (Supply Chain suite, Installation Issues component) allows a remote, unauthenticated attacker over HTTP to fully read all data the application can access and partially disrupt service. The flaw carries a scope change, so successful attacks may significantly impact adjacent Oracle products beyond the analytics component itself. Rated CVSS 3.1 9.3 (Critical); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local privilege-to-scope-change compromise in Oracle Product Lifecycle Analytics 3.6.1 (Oracle Supply Chain, Installation Issues component) lets an attacker with logon access to the host where the software runs take over the application without application-level credentials. Successful exploitation yields full read and write access to all data accessible to Oracle Product Lifecycle Analytics and, because of a CVSS scope change, may significantly impact other products on the same infrastructure. No public exploit identified at time of analysis; the flaw was reported by Oracle and fixed in the July 2026 Critical Patch Update.
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Oracle Product Lifecycle Analytics 3.6.1 exposes a network-exploitable flaw in its Installation Issues component, allowing a high-privileged attacker to achieve full confidentiality and integrity compromise of all accessible application data alongside partial service disruption via HTTP. The 'Installation Issues' component designation and the 'Authentication Bypass' intelligence tag together suggest the flaw may reside in insecure post-installation artifacts, exposed setup endpoints, or improperly secured administrative interfaces left accessible after deployment. No public exploit has been identified at time of analysis, and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.
Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has...
Vulnerability in the Advanced Networking Option component of Oracle Database Server. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to allocate large amounts of memory that leads to an out of memory error, even for small inputs. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity.