Live › vulnerability › CVE-2026-101471
Go to dashboardOracle Product Lifecycle Analytics version 3.6.1 has an installation-component flaw that lets a low-privileged user with logon to the host reach data they should not see and partly disrupt the service. The CVSS 3.1 score is 6.1, with high confidentiality impact and low availability impact.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running Oracle Product Lifecycle Analytics 3.6.1 on a server where other users hold local logon. The sources describe a local attack that needs an account on the infrastructure that runs the product, so the exposure is about who can log on to that host. Teams on other versions or without local user accounts on the host can skip it.
No product ranges from the sources yet.
3.6.1Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: Installation Issues). The supported version that is affected is 3.6.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Product Lifecycle Analytics executes to compromise Oracle Product Lifecycle Analytics. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Product Lifecycle Analytics accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Product Lifecycle Analytics. CVSS 3.1 Base Score 6.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L).
This page as .md · .json · in your agent: get_signal("CVE-2026-101471")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.