Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-61175: Oracle Supply Chain: Unauthenticated Access to Critical Data

CVE-2026-61175 · published 3 months ago

Summary

A vulnerability in Oracle Supply Chain's Product Lifecycle Analytics product, version 3.6.1, allows an attacker to access sensitive data without a password. This could lead to unauthorized access to critical information or disrupt access to the analytics tool. Oracle recommends updating to a fixed version to protect against this issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
oracle corporation	oracle product lifecycle analytics	3.6.1
oracle	product_lifecycle_analytics	3.6.1 `cpe:2.3:a:oracle:product_lifecycle_analytics:3.6.1:::::::*`

Original advisory text

Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: Installation Issues). The supported version that is affected is 3.6.1. Easily exploitable vulner...

Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: Installation Issues). The supported version that is affected is 3.6.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Product Lifecycle Analytics. While the vulnerability is in Oracle Product Lifecycle Analytics, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Product Lifecycle Analytics accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Product Lifecycle Analytics. CVSS 3.1 Base Score 9.3 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L).

References

https://www.oracle.com/security-alerts/cpujul2026.html vendor-advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

9.3 Critical

Exploitation

<1% chance of attack within 30 days

Type

CWE-200Information Exposure

CWE-306Missing Authentication for Critical Function

Timeline

Published21 Jul 2026

Updated4 Nov 2026

First seen23 Jul 2026

Sources

CVE-2026-61175 · NVD

CVE-2026-61175 · MITRE

Track software like this

Free during beta