This vulnerability affects Oracle Agile PLM MCAD Connector version 3.6. It requires an attacker to have physical access to the communication segment attached to the hardware where the connector executes, making exploitation difficult. Successful exploitation results in unauthorized access to critical or all data accessible by the connector. The CVSS vector indicates attack vector as adjacent network (AV:A), high attack complexity (AC:H), no privileges required (PR:N), no user interaction (UI:N), unchanged scope (S:U), high confidentiality impact (C:H), no integrity or availability impact (I:N, A:N). No known exploits in the wild have been reported. Oracle has included this vulnerability in their August 2026 Critical Security Patch Update advisory but has not explicitly stated patch availability for this specific issue in the provided content.

An attacker with physical access to the communication segment of the hardware running Oracle Agile PLM MCAD Connector 3.6 can gain unauthorized access to critical or all data accessible by the connector. This compromises confidentiality but does not affect integrity or availability. The difficulty of exploitation and requirement for physical network access limit the risk to environments where such access is possible.

Oracle recommends applying security patches promptly as part of their Critical Security Patch Update program. However, the vendor advisory does not explicitly confirm a patch for this specific vulnerability. Customers should monitor Oracle's official security alerts and apply relevant updates when available. Given the requirement for physical access to the communication segment, restricting physical and network access to the hardware running Oracle Agile PLM MCAD Connector can reduce risk.