This vulnerability affects Oracle Agile PLM MCAD Connector version 3.6 and involves a difficult-to-exploit flaw that requires the attacker to have physical access to the communication segment attached to the hardware where the software executes. Additionally, successful exploitation requires human interaction from a third party. The impact includes unauthorized read and modification (update, insert, delete) of some accessible data within the product. The CVSS 3.1 base score is 3.7, reflecting low confidentiality and integrity impacts with no availability impact. The attack vector is adjacent network (physical communication segment), with high attack complexity, no privileges required, and user interaction needed.

The vulnerability can result in unauthorized read and modification (update, insert, delete) of some data accessible by Oracle Agile PLM MCAD Connector. However, exploitation is difficult due to the need for physical access to the communication segment and required human interaction from a user other than the attacker. The overall impact is limited to confidentiality and integrity with no availability impact, and the severity is low.

The vendor advisory does not explicitly state the availability of a patch or fix for this specific vulnerability. Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for current remediation guidance. Oracle recommends applying security patches promptly and remaining on actively supported versions. Since this vulnerability requires physical access and user interaction, limiting physical access to hardware and educating users about social engineering risks may help mitigate exploitation.