CVE-2026-83261

A critical (CVSS 9.8) vulnerability in the Core component of Oracle Product Lifecycle Analytics, part of the Oracle Supply Chain suite, affects version 3.6.1. It is easily exploitable by an unauthenticated attacker with network access via HTTP, requiring no privileges and no user interaction, and successful attacks can result in complete takeover of the Product Lifecycle Analytics installation with high impact on confidentiality, integrity, and availability. In practice, this means an attacker who can reach the application's web endpoint could seize control of the product and its data. Organizations running the affected version exposed to internal or external networks are at risk. No public proof-of-concept is known, the flaw is not on CISA's KEV list, and no in-the-wild exploitation has been reported to date.

What to do: Apply the Oracle Critical Patch Update that addresses this flaw in Product Lifecycle Analytics and confirm the patched version in the relevant Oracle advisory, since only 3.6.1 is listed as affected. Until patched, restrict HTTP access to the application to trusted networks (VPN, firewall allowlisting) rather than leaving it broadly reachable, and front it with authentication at a proxy or SSO layer if possible. Review application and server logs for unexplained account changes, unknown sessions, or data exfiltration indicating prior compromise.