CVE-2026-61174 is a critical (CVSS 9.0) access control flaw in Oracle Product Lifecycle Analytics 3.6.1, in the Installation Issues component. It needs local access to the host where the product runs. Apply the fix from Oracle's July 2026 Critical Patch Update and limit who can log on to that infrastructure.
What's affected
- Product: Oracle Product Lifecycle Analytics, part of Oracle Supply Chain.
- Affected version: 3.6.1, the supported version named in the record.
- Component: Installation Issues.
- Weakness: CWE-284, improper access control. CVSS 9.0 (critical), vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N. - The attack vector is local. Oracle describes an unauthenticated attacker with logon to the infrastructure where the product runs, and a possible scope change affecting other products.
How to check if you're exposed
Check the installed version using your Oracle product documentation, or the version your deployment tooling reports. Then compare it with 3.6.1.
The fix is delivered through Oracle's quarterly Critical Patch Update. I could not load the July 2026 page when I reviewed this, so read the Oracle advisory for the patch number, the exact fix and any prerequisites. Your Oracle support account will list the patch for your platform.
What to do now
- Confirm whether you run Oracle Product Lifecycle Analytics 3.6.1.
- Read the Oracle Critical Patch Update for July 2026 and apply the listed patch.
- Review who can log on to the servers hosting the product, and remove accounts that do not need access.
- Keep a record of the patch date for your change log.
Why it matters
The vector says local. An attacker needs a way to log on to the machine, which narrows who can use the flaw but raises the stakes if a low level account or a shared host is already in the picture. The record notes a possible effect on other products, which is what the changed scope in the vector means.
The weakness class is CWE-284, improper access control, a broad bucket. Oracle's text says the impact covers unauthorized creation, deletion or modification of critical data and access to all data the product can reach. The KEV flag is false.
Quick check
Can this be exploited from the internet?
The vector is local, so an attacker needs logon access to the infrastructure where the product runs, according to Oracle's description.
Where is the fix?
In Oracle's July 2026 Critical Patch Update. Check it for the patch for your platform.
Sources
- Oracle Critical Patch Update, July 2026 (listed in the record, but its details did not load when I reviewed it)
Last reviewed: 19 October 2026.
