The vulnerability is a local privilege escalation issue in Oracle Product Lifecycle Analytics 3.6.1, identified as CWE‑400 for uncontrolled resource consumption. A low‑privileged attacker who has logged onto the infrastructure where the product runs can exploit this flaw to read all data that the product is allowed to access and to trigger a partial denial of service. This leads to confidentiality loss for all data under the product’s control and moderate availability impact for the operations relying on the application.

Oracle Corporation’s Product Lifecycle Analytics version 3.6.1 is the only version listed as affected. No other variants are currently impacted according to the vendor advisory.

The CVSS 3.1 base score of 6.1 signals medium severity, with confidentiality high, integrity unchanged, and availability low. The EPSS score is under 1%, indicating a very low probability of exploitation in the wild, and the vulnerability is not in the CISA KEV catalog. Exploitation requires a user who has local logon privileges on the host where the application runs; thus the likely attack vector is an internal or compromised account scenario. Successful attacks can grant the attacker unauthorized access to sensitive data or a partial denial of service of the Product Lifecycle Analytics application.