The vulnerability allows a low-privileged attacker with network access to provide arbitrary SQL that can be executed by Oracle Product Lifecycle Analytics, potentially leading to full compromise of the system. Successful exploitation results in loss of confidentiality, integrity, and availability for the affected installation.

The affected product is Oracle Product Lifecycle Analytics version 3.6.1, part of Oracle Supply Chain.

The CVSS v3.1 base score is 7.5, indicating high severity with full confidentiality, integrity, and availability impacts. The EPSS score is <1%, indicating a very low probability of exploitation in the field, but not zero. The vulnerability is not listed in the CISA KEV catalog, so no publicly known exploits are reported at this time. Attackers would require network access to the product and the ability to submit arbitrary SQL. Though the description notes that the exploit is difficult to carry out, suggesting that specific conditions or knowledge may be required.