The vulnerability affects Oracle Agile PLM MCAD Connector version 3.6 and requires physical access to the communication segment attached to the hardware where the software executes. It allows an unauthenticated attacker to gain unauthorized access to critical data and perform unauthorized modifications on some data. The CVSS 3.1 vector indicates the attack vector is adjacent network (AV:A), with high attack complexity (AC:H), no privileges required (PR:N), no user interaction (UI:N), unchanged scope (S:U), high confidentiality impact (C:H), low integrity impact (I:L), and no availability impact (A:N). Oracle's August 2026 Critical Security Patch Update advisory references this vulnerability but does not provide explicit patch details for version 3.6 of the product in the provided excerpt.

Successful exploitation can result in unauthorized access to critical data and unauthorized update, insert, or delete operations on some data accessible through Oracle Agile PLM MCAD Connector version 3.6. The confidentiality impact is high, while integrity impact is low, and availability is not affected. The attack requires physical access to the communication segment, making exploitation difficult.

Oracle has included this vulnerability in its August 2026 Critical Security Patch Update advisory. However, the provided data does not explicitly confirm the availability of a patch for Oracle Agile PLM MCAD Connector version 3.6. Customers should consult the official Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for the latest patch and remediation information. Oracle strongly recommends applying security patches without delay and remaining on actively supported versions. Until a patch is confirmed, restrict physical access to the communication segments attached to the hardware running the connector to mitigate risk.