Description
Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: Installation Issues). The supported version that is affected is 3.6.1. Difficult to exploit vulnerability allows low privileged attacker with network access via SQL to compromise Oracle Product Lifecycle Analytics. Successful attacks of this vulnerability can result in takeover of Oracle Product Lifecycle Analytics. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-10-20
Score: 7.5 High
EPSS: n/a
KEV: No
Impact: Full takeover of Oracle Product Lifecycle Analytics
Action: Patch Now
AI Analysis

Impact

The vulnerability in Oracle Product Lifecycle Analytics allows an attacker with network access to execute SQL commands that upgrade a low‑privileged user to full control of the system. Successful exploitation results in loss of confidentiality, integrity, and availability for the affected installation.

Affected Systems

The affected product is Oracle Product Lifecycle Analytics version 3.6.1, part of Oracle Supply Chain."

Risk and Exploitability

The CVSS v3.1 base score is 7.5, indicating a high severity with full confidentiality, integrity, and availability impacts. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, so no publicly known exploits are reported at this time. Attackers would require network access to the product and the ability to submit arbitrary SQL, but the description notes that the exploit is difficult to carry out, suggesting that specific conditions or knowledge may be required.

Generated by OpenCVE AI on October 20, 2026 at 23:41 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Oracle Product Lifecycle Analytics to a version that does not contain the vulnerability
  • Restrict network access to the application by limiting connections to trusted hosts and implementing firewall rules
  • Apply the principle of least privilege to all user accounts, removing any low‑privileged accounts that have unnecessary database access

Generated by OpenCVE AI on October 20, 2026 at 23:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 21 Oct 2026 00:00:00 +0000

Type Values Removed Values Added
Title Low‑Privilege SQL Injection Allows Full Compromise of Oracle Product Lifecycle Analytics
Weaknesses CWE-89

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: Installation Issues). The supported version that is affected is 3.6.1. Difficult to exploit vulnerability allows low privileged attacker with network access via SQL to compromise Oracle Product Lifecycle Analytics. Successful attacks of this vulnerability can result in takeover of Oracle Product Lifecycle Analytics. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle product Lifecycle Analytics
CPEs cpe:2.3:a:oracle:product_lifecycle_analytics:3.6.1:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle product Lifecycle Analytics
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Product Lifecycle Analytics
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-20T21:21:02.023Z

Reserved: 2026-09-28T15:40:09.485Z

Link: CVE-2026-101469

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-20T22:17:55.820

Modified: 2026-10-20T22:17:55.820

Link: CVE-2026-101469

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-20T23:45:14Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')