This vulnerability affects Oracle Agile PLM MCAD Connector version 3.6 and involves an easily exploitable weakness that permits a low privileged attacker who has access to the physical communication segment attached to the hardware where the product executes to compromise the software. The attacker can gain unauthorized read access to some data and unauthorized update, insert, or delete access to other data accessible by the product. The CVSS 3.1 base score is 4.6, reflecting low attack vector (adjacent network), low attack complexity, low privileges required, no user interaction, and impacts on confidentiality and integrity but not availability.

The vulnerability allows unauthorized disclosure and modification of some data accessible by Oracle Agile PLM MCAD Connector 3.6. This could lead to data integrity and confidentiality issues within the affected environment. There is no impact on availability. The attack requires physical network access, limiting the attack surface.

Oracle strongly recommends applying security patches promptly as part of their Critical Security Patch Update program. Although no specific patch link is provided for this vulnerability, it is included in Oracle's August 2026 Critical Security Patch Update. Customers should ensure they are running actively supported versions and apply the latest patches from Oracle's advisory at https://www.oracle.com/security-alerts/cspuaug2026.html. No additional mitigation steps are indicated in the advisory.