This vulnerability affects Oracle Agile PLM MCAD Connector version 3.6, specifically the CAX Client component. It allows a low privileged attacker with network access via HTTP to compromise the product, potentially resulting in full takeover. The CVSS 3.1 vector is AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, reflecting network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle has acknowledged this vulnerability in their August 2026 Critical Security Patch Update advisory but has not explicitly provided a direct patch link for this specific product in the advisory content provided.

Successful exploitation can lead to complete compromise of Oracle Agile PLM MCAD Connector version 3.6, affecting confidentiality, integrity, and availability of the system. This could allow an attacker to take over the affected component, potentially impacting the broader supply chain management environment that relies on this product.

Oracle has included this vulnerability in its August 2026 Critical Security Patch Update advisory. Customers are strongly advised to apply the relevant security patches from Oracle's Critical Security Patch Update promptly. Since no direct patch link was provided for this specific product in the advisory content, customers should consult the official Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for detailed patch availability and installation instructions. Staying on actively supported versions and timely patching is critical to mitigate this vulnerability.