SB20261107343 - Multiple vulnerabilities in Oracle Product Lifecycle Analytics

Description

This security bulletin contains information about 4 vulnerabilities.

1) Improper input validation (CVE-ID: CVE-2026-61176)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote privileged user to compromise the affected system.

The vulnerability exists due to improper input validation within the Installation Issues component in Oracle Product Lifecycle Analytics. A remote privileged user can exploit this vulnerability to compromise the affected system.

2) Improper Encoding or Escaping of Output (CVE-ID: CVE-2026-34481)

CWE-ID: CWE-116 - Improper Encoding or Escaping of Output

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause downstream log processing systems to reject or fail to index affected records.

The vulnerability exists due to improper serialization of non-finite floating-point values in JsonTemplateLayout when processing log events containing a MapMessage with an attacker-controlled floating-point value. A remote attacker can supply a non-finite floating-point value to cause downstream log processing systems to reject or fail to index affected records.

Exploitation is possible only if the application uses JsonTemplateLayout and logs a MapMessage containing the attacker-controlled value.

3) Improper input validation (CVE-ID: CVE-2026-61174)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Installation Issues component in Oracle Product Lifecycle Analytics. A local non-authenticated attacker can exploit this vulnerability to read and manipulate data.

4) Improper input validation (CVE-ID: CVE-2026-61175)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Installation Issues component in Oracle Product Lifecycle Analytics. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

Remediation

Install update from vendor's website.

References

• https://www.oracle.com/security-alerts/cpujul2026.html