CVE-2026-61174
A critical flaw in Oracle Product Lifecycle Analytics 3.6.1 lets anyone who can log onto the same infrastructure as the product gain full control over the application. The bug can be used to create, delete, or change any data stored in the system, and to read all data. It is easy to exploit and requires no special privileges.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Oracle Product Lifecycle Analytics version 3.6.1 (Oracle Supply Chain).
Real-world impact
An attacker who can log onto the host can modify or delete data, create new data, or read all data stored in the application, effectively taking full control of the system.
Why this severity
The CVSS score of 9.0 reflects that the vulnerability is local, requires no authentication, and changes the scope of the affected component, giving an attacker full confidentiality and integrity compromise. The low attack complexity and lack of required privileges make it highly exploitable.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources