This vulnerability affects Oracle Agile PLM MCAD Connector version 3.6, specifically the CAX Client component. It allows an attacker with low privileges and network access over HTTP to compromise the product, potentially leading to unauthorized access to critical or all accessible data within the Oracle Agile PLM MCAD Connector environment. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, no user interaction needed, unchanged scope, and high confidentiality impact without integrity or availability impact.

Successful exploitation results in unauthorized access to critical data or complete access to all data accessible by Oracle Agile PLM MCAD Connector version 3.6. There is no reported impact on data integrity or availability. The vulnerability is considered medium severity due to its confidentiality impact and ease of exploitation.

Oracle has released a Critical Security Patch Update (CSPU) in August 2026 which addresses this vulnerability among others. Customers are strongly advised to apply the available security patches promptly to mitigate this vulnerability. No indication was provided that the vulnerability is already mitigated or requires no action. Since this is not a cloud service, patching must be applied by customers. Refer to the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for patch availability and installation instructions.