The vulnerability resides in the installation component of Oracle Product Lifecycle Analytics version 3.6.1, where a high privileged attacker who can log on to the underlying infrastructure can create, delete, or modify critical data. This leads to confidentiality and integrity breaches, allowing unauthorized access to all data that the application serves. The weakness aligns with CWE‑284: Improper Access Control.

Oracle Corporation’s Product Lifecycle Analytics 3.6.1 is affected. The vulnerability is specifically present in the installation issues component of the product. No other product versions or vendors are listed as impacted.

The CVSS base score is 6.0, indicating medium severity, and the attack requires local access with high privileges, meaning the threat is limited to users who already have privileged credentials on the host. Because the exploitability relies on logon credentials, an attacker would need to compromise or gain permission to the environment hosting the service. EPSS data is unavailable, and the vulnerability is not currently listed in the CISA KEV catalog, suggesting no known active exploitation at this time, but the local nature of the attack encourages strict containment and monitoring.