This vulnerability affects Oracle Agile PLM MCAD Connector version 3.6, specifically the CAX Client component. It permits an unauthenticated attacker with network access over HTTP to compromise the product, potentially resulting in full takeover. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability. The attack complexity is high, and no privileges or user interaction are required. Oracle has listed this vulnerability in its August 2026 Critical Security Patch Update advisory but has not explicitly detailed a separate patch for this version outside that update.

Successful exploitation can lead to complete compromise of Oracle Agile PLM MCAD Connector 3.6, affecting confidentiality, integrity, and availability of the system. The vulnerability allows takeover without authentication, though it is difficult to exploit due to high attack complexity.

Oracle has addressed this vulnerability as part of its August 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant patches from this update promptly. Oracle recommends remaining on actively supported versions and applying security patches without delay to mitigate this and other vulnerabilities. No additional mitigation steps are indicated beyond patching.