This vulnerability affects Oracle Agile PLM MCAD Connector version 3.6. It is difficult to exploit and requires an attacker to have logon access to the infrastructure where the connector runs, as well as human interaction from another user. Exploitation can result in unauthorized ability to read, update, insert, or delete some data accessible by the connector, and cause partial denial of service. The CVSS vector is AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L, reflecting local attack vector, high attack complexity, no privileges required, user interaction required, unchanged scope, and low impacts on confidentiality, integrity, and availability. No known exploits in the wild have been reported. The vendor advisory does not explicitly mention a patch for this specific vulnerability but references a Critical Security Patch Update released in August 2026 covering multiple products including Oracle Agile PLM MCAD Connector 3.6.

An attacker with local logon access to the infrastructure and requiring human interaction from another user can gain unauthorized read, update, insert, or delete access to some data accessible by Oracle Agile PLM MCAD Connector 3.6. Additionally, the attacker can cause a partial denial of service affecting availability. The impact on confidentiality, integrity, and availability is rated low but still significant enough to warrant attention.

Oracle has released a Critical Security Patch Update in August 2026 that includes fixes for vulnerabilities affecting Oracle Agile PLM MCAD Connector version 3.6. Customers are strongly advised to apply the relevant patches from this update promptly. The vendor advisory emphasizes the importance of applying available patches without delay to prevent exploitation. No additional mitigation steps are specifically recommended beyond patching.