This vulnerability affects Oracle Agile PLM MCAD Connector version 3.6 and involves a security flaw in the CAX Client component. An attacker with low privileges and logon access to the infrastructure can exploit this vulnerability, but it requires human interaction from a third party. The impact includes unauthorized read and modification (update, insert, delete) of accessible data and the ability to cause a partial denial of service. The CVSS vector indicates local attack vector, high attack complexity, low privileges required, user interaction required, unchanged scope, and low impact on confidentiality, integrity, and availability.

The vulnerability can result in unauthorized read and modification of some data accessible to Oracle Agile PLM MCAD Connector, as well as partial denial of service. The attack requires local access and user interaction, limiting the ease of exploitation. The overall impact on confidentiality, integrity, and availability is low, reflected in the CVSS score of 4.2.

Oracle has published a Critical Security Patch Update in August 2026 that addresses multiple vulnerabilities across its products, including Oracle Agile PLM MCAD Connector. Customers are strongly advised to apply the available security patches promptly to mitigate this vulnerability. No indication was given that the vulnerability is already mitigated or requires no action. Therefore, applying the official Oracle patches is the recommended remediation.