CVE-2026-71049: Oracle Product Lifecycle Analytics Auth Bypass

CVE-2026-71049 Overview

CVE-2026-71049 is an access control vulnerability [CWE-284] in Oracle Product Lifecycle Analytics, a component of the Oracle Supply Chain product family. The affected version is 3.6.1, and the flaw resides in the Installation Issues component. A low-privileged attacker with network access via Oracle Net can exploit this vulnerability without user interaction. Successful exploitation results in unauthorized access to critical data and unauthorized modification of a subset of accessible data. The vulnerability introduces a scope change, meaning attacks against Oracle Product Lifecycle Analytics may impact additional Oracle products beyond the vulnerable component.

Critical Impact
Authenticated network attackers can obtain complete read access to Oracle Product Lifecycle Analytics data and modify a subset of that data, with impact extending to adjacent Oracle products due to scope change.

Affected Products

Oracle Product Lifecycle Analytics 3.6.1
Oracle Supply Chain (Product Lifecycle Analytics component)
Installation Issues subcomponent

Discovery Timeline

2026-08-18 - CVE-2026-71049 published to NVD
2026-08-20 - Last updated in NVD database
Oracle Security Alert CSPUAUG2026 published as vendor advisory

Technical Details for CVE-2026-71049

Vulnerability Analysis

The vulnerability is categorized as Improper Access Control [CWE-284] within the Installation Issues component of Oracle Product Lifecycle Analytics. Access control weaknesses allow authenticated users to perform actions beyond their assigned authorization boundary. In this case, a low-privileged account with Oracle Net connectivity can reach resources that should require higher privileges.

Because the flaw produces a scope change, the trust boundary between the vulnerable component and other Oracle Supply Chain products is not enforced. An attacker who compromises Product Lifecycle Analytics can pivot to affect confidentiality and integrity in downstream systems that consume its data or share its authentication context.

Root Cause

The root cause is improper enforcement of access control policies in the Installation Issues component of Oracle Product Lifecycle Analytics 3.6.1. Authorization checks fail to restrict a low-privileged authenticated user from reading sensitive data or writing to a subset of resources. Oracle has not published implementation-level detail beyond the advisory reference in Oracle Security Alert CSPUAUG2026.

Attack Vector

Exploitation requires network reachability to the Oracle Net listener and a low-privileged account on the target. The attacker sends requests through Oracle Net that invoke functionality without adequate authorization enforcement. No user interaction is required, and attack complexity is low. Successful exploitation yields full read access to Product Lifecycle Analytics data and partial write access, with confidentiality and integrity impact extending into adjacent Oracle products through the scope change.

No public proof-of-concept or exploit code has been released for CVE-2026-71049 at the time of publication. See the Oracle Security Alert CSPUAUG2026 for vendor-provided technical detail.

Detection Methods for CVE-2026-71049

Indicators of Compromise

Unexpected Oracle Net sessions from low-privileged accounts accessing Product Lifecycle Analytics schemas or objects
Read or write operations against Product Lifecycle Analytics data by accounts without a documented business need
Anomalous SQL activity from application-tier accounts targeting installation-related tables or procedures
Cross-product data access patterns that traverse the Product Lifecycle Analytics boundary into other Oracle Supply Chain components

Detection Strategies

Enable Oracle Database auditing on the Product Lifecycle Analytics schema, focusing on SELECT, INSERT, UPDATE, and DELETE operations by non-administrative accounts
Baseline expected Oracle Net client sources and alert on connections from unexpected network segments
Correlate authentication events for low-privileged accounts against subsequent data access volume to identify privilege abuse

Monitoring Recommendations

Forward Oracle Database audit logs and listener logs to a centralized analytics platform for correlation with network telemetry
Track query patterns that indicate scope-change abuse, such as a single session accessing objects across multiple Oracle Supply Chain components
Monitor for schema enumeration activity following authentication by service or application accounts

How to Mitigate CVE-2026-71049

Immediate Actions Required

Apply the patches referenced in Oracle Security Alert CSPUAUG2026 to all Oracle Product Lifecycle Analytics 3.6.1 deployments
Inventory all accounts with network access to the affected Oracle Net listener and remove those without a current business justification
Restrict Oracle Net listener exposure to trusted management networks only
Rotate credentials for low-privileged accounts that could have reached the vulnerable component

Patch Information

Oracle addressed CVE-2026-71049 in the security alert cycle referenced as CSPUAUG2026. Administrators should review the Oracle Security Alert CSPUAUG2026 for the specific patch identifiers, prerequisite Critical Patch Updates, and post-installation steps applicable to Oracle Product Lifecycle Analytics 3.6.1.

Workarounds

Place the Oracle Net listener behind network access control lists that permit only required application hosts
Enforce least-privilege role assignments in Oracle Product Lifecycle Analytics and revoke unnecessary object-level grants
Enable Oracle Database Vault or equivalent access control realms to enforce separation between Product Lifecycle Analytics and adjacent Oracle Supply Chain data
Increase audit coverage on Product Lifecycle Analytics objects until the vendor patch is applied

bash

# Configuration example: restrict Oracle Net listener with valid node checking
# Add to sqlnet.ora on the database server
tcp.validnode_checking = yes
tcp.invited_nodes = (app-host-1.example.com, app-host-2.example.com)
tcp.excluded_nodes = (0.0.0.0/0)