CVE-2026-61175: Oracle Product Lifecycle Analytics Flaw

CVE-2026-61175 Overview

CVE-2026-61175 affects Oracle Product Lifecycle Analytics version 3.6.1, part of the Oracle Supply Chain product family. The flaw resides in the Installation Issues component and allows an unauthenticated remote attacker with HTTP network access to compromise the application. Oracle disclosed the issue in the July 2026 Critical Patch Update. The vulnerability carries a CVSS 3.1 base score of 9.3, driven by a scope change that lets attacks impact adjacent products. Successful exploitation grants unauthorized access to all data accessible through Oracle Product Lifecycle Analytics and enables a partial denial of service against the application.

Critical Impact
Unauthenticated network attackers can read all data accessible to Oracle Product Lifecycle Analytics and trigger partial denial of service, with impact extending beyond the vulnerable component due to scope change.

Affected Products

Oracle Product Lifecycle Analytics 3.6.1
Oracle Supply Chain product family
Installation Issues component of Oracle Product Lifecycle Analytics

Discovery Timeline

2026-07-21 - CVE-2026-61175 published to the National Vulnerability Database
2026-07-21 - Last updated in NVD database
July 2026 - Addressed in the Oracle Security Alert July 2026

Technical Details for CVE-2026-61175

Vulnerability Analysis

The vulnerability resides in the Installation Issues component of Oracle Product Lifecycle Analytics 3.6.1. An attacker reaches the vulnerable code path over HTTP without authentication and without user interaction. Oracle characterizes the issue as easily exploitable, indicating low attack complexity.

The scope change is a defining trait of this flaw. A successful attack starts in Oracle Product Lifecycle Analytics but affects resources managed by a different security authority. This behavior typically occurs when the vulnerable component exposes credentials, tokens, or backend connections to systems outside its own trust boundary.

Impact focuses on confidentiality and availability. Attackers gain complete read access to data reachable by the application, while integrity remains untouched. Availability impact is partial, indicating that attackers can degrade service without causing a full outage. Oracle has not published detailed technical write-ups for this issue beyond the July 2026 advisory.

Root Cause

Oracle documents the flaw under Installation Issues, suggesting configuration or deployment defects in installer-managed components rather than a runtime application bug. The absence of authentication requirements combined with a scope change points to exposed installation artifacts, default credentials, or misconfigured backend service endpoints that trust unauthenticated HTTP callers.

Attack Vector

An unauthenticated attacker sends crafted HTTP requests to a network-reachable Oracle Product Lifecycle Analytics 3.6.1 instance. The attacker does not require prior access, valid credentials, or user interaction. Because of the scope change, the attacker can pivot from Product Lifecycle Analytics into adjacent Oracle products it integrates with, expanding the blast radius. Refer to the Oracle Security Alert July 2026 for vendor guidance on affected deployments.

Detection Methods for CVE-2026-61175

Indicators of Compromise

Unauthenticated HTTP requests to Oracle Product Lifecycle Analytics installation or setup endpoints from external or untrusted internal sources.
Unusual outbound data flows from the Product Lifecycle Analytics host to attacker infrastructure, indicating bulk data extraction.
Access to backend systems integrated with Product Lifecycle Analytics from the application host outside normal batch windows.

Detection Strategies

Review web server and application logs for unauthenticated requests to Product Lifecycle Analytics 3.6.1 endpoints, especially those associated with installation, configuration, or diagnostic paths.
Correlate authentication logs with request volume to spot anomalous sessions that bypass login flows.
Baseline database and service account activity originating from the Product Lifecycle Analytics application tier and alert on deviations.

Monitoring Recommendations

Enable verbose HTTP access logging on Oracle Product Lifecycle Analytics front-end servers and forward logs to a centralized SIEM.
Monitor for scope-changing behavior such as Product Lifecycle Analytics service accounts touching resources outside their documented scope.
Track network egress from the application host and alert on transfers to previously unseen destinations.

How to Mitigate CVE-2026-61175

Immediate Actions Required

Apply the patches published in the Oracle Critical Patch Update July 2026 to all Oracle Product Lifecycle Analytics 3.6.1 deployments.
Restrict inbound HTTP access to Product Lifecycle Analytics servers to trusted management networks until patching is confirmed.
Audit integrations between Product Lifecycle Analytics and adjacent Oracle products to identify data exposed by a scope-changing attack.

Patch Information

Oracle addressed CVE-2026-61175 in the Critical Patch Update released in July 2026. Administrators running Oracle Product Lifecycle Analytics 3.6.1 must apply the vendor-supplied fixes referenced in the Oracle Security Alert July 2026. Oracle recommends applying Critical Patch Update fixes without delay because unpatched instances remain frequent targets.

Workarounds

Place Product Lifecycle Analytics behind a reverse proxy or web application firewall configured to block unauthenticated access to installation and setup endpoints.
Isolate the application in a segmented network zone and restrict egress to only required backend services.
Disable or remove any installation-time endpoints that are not required for production operation.

bash

# Example: restrict HTTP access to Product Lifecycle Analytics to a management CIDR
# Adjust interface, CIDR, and port to match your deployment
iptables -A INPUT -p tcp --dport 443 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP