cve-2026-71051
HIGH CVSS 8.8 opencve
Description
Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: Installation Issues). The supported version that is affected is 3.6.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Product Lifecycle Analytics executes to compromise Oracle Product Lifecycle Analytics. While the vulnerability is in Oracle Product Lifecycle Analytics, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Product Lifecycle Analytics. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
Timeline
- Published
- 2026-08-18 21:18 UTC
- Last Modified
- 2026-08-27
CVSS Details
CVSS details not available.
Affected Products
No product information available.
CVSS metrics
| Version | Base | Severity | Vector | Exploitability | Impact | Source |
|---|---|---|---|---|---|---|
| 3.1 | 8.8 | HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
mitre | ||
| 3.1 | 8.8 | HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
nvd | ||
| 3.1 | 8.8 | HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
opencve |
References
No references available.
Linked Vulnerabilities
No linked vulnerabilities found.
{
"cve": "CVE-2026-71051",
"enrichment": {
"affected": [
{
"configurations": [
{
"platform": null,
"status": "affected",
"versions": {
"scheme": "semver",
"value": "3.6.1"
}
}
],
"enrichment": {
"confidence": 90.0,
"confidence_source": "inferred",
"scores": [
{
"score": 90.0,
"source": "inferred"
},
{
"score": 100.0,
"source": "matching"
}
]
},
"original": {
"product": "Oracle Product Lifecycle Analytics",
"source": "cna",
"vendor": "Oracle Corporation"
},
"product": "product_lifecycle_analytics",
"vendor": "oracle"
}
],
"created": "2026-08-19T05:15:05.528010+00:00",
"updated": "2026-08-21T03:00:04.585752+00:00",
"vendors": [
"oracle",
"oracle$PRODUCT$product_lifecycle_analytics"
]
},
"epss": {
"score": 0.00161
},
"mitre": {
"cpes": [
"cpe:2.3:a:oracle:product_lifecycle_analytics:3.6.1:*:*:*:*:*:*:*"
],
"created": "2026-08-18T21:03:15.507000+00:00",
"description": "Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: Installation Issues). The supported version that is affected is 3.6.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Product Lifecycle Analytics executes to compromise Oracle Product Lifecycle Analytics. While the vulnerability is in Oracle Product Lifecycle Analytics, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Product Lifecycle Analytics. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).",
"metrics": {
"cvssV2_0": {},
"cvssV3_0": {},
"cvssV3_1": {
"score": 8.8,
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
},
"cvssV4_0": {}
},
"mitre_repo_path": "cves/2026/71xxx/CVE-2026-71051.json",
"references": [
"https://www.oracle.com/security-alerts/cspuaug2026.html"
],
"title": null,
"updated": "2026-08-25T03:55:54.431000+00:00",
"vendors": [
"oracle",
"oracle$PRODUCT$product_lifecycle_analytics"
],
"weaknesses": []
},
"nvd": {
"cpes": [
"cpe:2.3:a:oracle:product_lifecycle_analytics:3.6.1:*:*:*:*:*:*:*"
],
"created": "2026-08-18T21:18:04.940000+00:00",
"description": "Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: Installation Issues). The supported version that is affected is 3.6.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Product Lifecycle Analytics executes to compromise Oracle Product Lifecycle Analytics. While the vulnerability is in Oracle Product Lifecycle Analytics, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Product Lifecycle Analytics. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).",
"metrics": {
"cvssV2_0": {},
"cvssV3_0": {},
"cvssV3_1": {
"score": 8.8,
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
},
"cvssV4_0": {}
},
"nvd_repo_path": "2026/CVE-2026-71051.json",
"references": [
"https://www.oracle.com/security-alerts/cspuaug2026.html"
],
"title": null,
"updated": "2026-08-27T18:51:56.693000+00:00",
"vendors": [
"oracle",
"oracle$PRODUCT$product_lifecycle_analytics"
],
"weaknesses": [
"CWE-284"
]
},
"opencve": {
"changes": [
{
"created": "2026-08-18T21:15:00+00:00",
"data": [
{
"details": {
"new": "Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: Installation Issues). The supported version that is affected is 3.6.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Product Lifecycle Analytics executes to compromise Oracle Product Lifecycle Analytics. While the vulnerability is in Oracle Product Lifecycle Analytics, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Product Lifecycle Analytics. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).",
"old": null
},
"type": "description"
},
{
"details": [
"oracle",
"oracle$PRODUCT$product_lifecycle_analytics"
],
"type": "first_time"
},
{
"details": {
"added": [
"cpe:2.3:a:oracle:product_lifecycle_analytics:3.6.1:*:*:*:*:*:*:*"
],
"removed": []
},
"type": "cpes"
},
{
"details": {
"added": [
"oracle",
"oracle$PRODUCT$product_lifecycle_analytics"
],
"removed": []
},
"type": "vendors"
},
{
"details": {
"added": [
"https://www.oracle.com/security-alerts/cspuaug2026.html"
],
"removed": []
},
"type": "references"
},
{
"details": {
"added": {
"cvssV3_1": {
"score": 8.8,
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
}
},
"removed": {},
"updated": {}
},
"type": "metrics"
}
],
"id": "bc62f7cd-3c22-4ecd-b078-2256abf8533a"
},
{
"created": "2026-08-19T05:30:00+00:00",
"data": [
{
"details": {
"new": "Local Privilege Escalation Enables Full Compromise of Oracle Product Lifecycle Analytics 3.6.1",
"old": null
},
"type": "title"
},
{
"details": {
"added": [
"CWE-284",
"CWE-862"
],
"removed": []
},
"type": "weaknesses"
}
],
"id": "7d4879ce-6512-4552-a50e-62d8ca422b57"
},
{
"created": "2026-08-19T15:00:00+00:00",
"data": [
{
"details": {
"new": null,
"old": "Local Privilege Escalation Enables Full Compromise of Oracle Product Lifecycle Analytics 3.6.1"
},
"type": "title"
},
{
"details": {
"added": [],
"removed": [
"CWE-284",
"CWE-862"
]
},
"type": "weaknesses"
}
],
"id": "0cdd6b62-4dac-4fb9-8060-43b66ab86590"
},
{
"created": "2026-08-19T22:15:00+00:00",
"data": [
{
"details": {
"new": "Local Privilege Escalation in Oracle Product Lifecycle Analytics Leading to Full Application Compromise",
"old": null
},
"type": "title"
},
{
"details": {
"added": [
"CWE-264"
],
"removed": []
},
"type": "weaknesses"
}
],
"id": "c69a857a-bacd-4ab8-8148-814ab0546039"
},
{
"created": "2026-08-20T06:15:00+00:00",
"data": [
{
"details": {
"new": null,
"old": "Local Privilege Escalation in Oracle Product Lifecycle Analytics Leading to Full Application Compromise"
},
"type": "title"
},
{
"details": {
"added": [],
"removed": [
"CWE-264"
]
},
"type": "weaknesses"
}
],
"id": "8eac5204-08ce-45a6-b941-e03425e88c58"
},
{
"created": "2026-08-20T18:30:00+00:00",
"data": [
{
"details": {
"added": [
"CWE-284"
],
"removed": []
},
"type": "weaknesses"
},
{
"details": {
"added": {
"ssvc": {
"options": {
"Automatable": "no",
"Exploitation": "none",
"Technical Impact": "total"
},
"version": "2.0.3"
}
},
"removed": {},
"updated": {}
},
"type": "metrics"
}
],
"id": "0aea71b8-6977-4827-b37a-bd32e4653848"
},
{
"created": "2026-08-20T19:00:00+00:00",
"data": [
{
"details": {
"new": "Local Privilege Escalation in Oracle Product Lifecycle Analytics Installation Component",
"old": null
},
"type": "title"
}
],
"id": "e851ffd1-de74-47e8-9340-40cb4a03351a"
},
{
"created": "2026-08-21T03:15:00+00:00",
"data": [
{
"details": {
"new": null,
"old": "Local Privilege Escalation in Oracle Product Lifecycle Analytics Installation Component"
},
"type": "title"
}
],
"id": "81823d86-866b-4601-978b-1540dbcdfc27"
}
],
"cpes": {
"data": [
"cpe:2.3:a:oracle:product_lifecycle_analytics:3.6.1:*:*:*:*:*:*:*"
],
"providers": [
"mitre",
"nvd"
]
},
"created": {
"data": "2026-08-18T21:03:15.507000+00:00",
"provider": "mitre"
},
"description": {
"data": "Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: Installation Issues). The supported version that is affected is 3.6.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Product Lifecycle Analytics executes to compromise Oracle Product Lifecycle Analytics. While the vulnerability is in Oracle Product Lifecycle Analytics, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Product Lifecycle Analytics. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).",
"provider": "mitre"
},
"metrics": {
"cvssV2_0": {
"data": {},
"provider": null
},
"cvssV3_0": {
"data": {},
"provider": null
},
"cvssV3_1": {
"data": {
"score": 8.8,
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
},
"provider": "mitre"
},
"cvssV4_0": {
"data": {},
"provider": null
},
"epss": {
"data": {
"score": 0.00161
},
"provider": "first"
},
"kev": {
"data": {},
"provider": null
},
"ssvc": {
"data": {
"options": {
"Automatable": "no",
"Exploitation": "none",
"Technical Impact": "total"
},
"version": "2.0.3"
},
"provider": "vulnrichment"
},
"threat_severity": {
"data": null,
"provider": null
}
},
"references": {
"data": [
"https://www.oracle.com/security-alerts/cspuaug2026.html"
],
"providers": [
"mitre",
"nvd"
]
},
"title": {
"data": null,
"provider": null
},
"updated": {
"data": "2026-08-21T03:00:04.585752+00:00",
"provider": "enrichment"
},
"vendors": {
"data": [
"oracle",
"oracle$PRODUCT$product_lifecycle_analytics"
],
"providers": [
"mitre",
"nvd",
"enrichment"
]
},
"weaknesses": {
"data": [
"CWE-284"
],
"providers": [
"nvd",
"vulnrichment"
]
}
},
"vulnrichment": {
"cpes": [],
"created": "2026-08-18T21:03:15.507000+00:00",
"description": "Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: Installation Issues). The supported version that is affected is 3.6.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Product Lifecycle Analytics executes to compromise Oracle Product Lifecycle Analytics. While the vulnerability is in Oracle Product Lifecycle Analytics, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Product Lifecycle Analytics. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).",
"metrics": {
"cvssV2_0": {},
"cvssV3_0": {},
"cvssV3_1": {},
"cvssV4_0": {},
"kev": {},
"ssvc": {
"options": {
"Automatable": "no",
"Exploitation": "none",
"Technical Impact": "total"
},
"version": "2.0.3"
}
},
"references": [],
"title": null,
"updated": "2026-08-20T17:51:20.791000+00:00",
"vendors": [],
"vulnrichment_repo_path": "2026/71xxx/CVE-2026-71051.json",
"weaknesses": [
"CWE-284"
]
}
}
Enrichment data
Aggregated bundle (all enrichments)