This vulnerability affects Oracle Agile PLM MCAD Connector version 3.6. It is difficult to exploit and requires an attacker to have access to the physical communication segment attached to the hardware where the product executes. Additionally, exploitation requires human interaction from a third party. If successfully exploited, the attacker can gain unauthorized update, insert, delete, and read access to some data accessible by the Oracle Agile PLM MCAD Connector. The CVSS 3.1 vector is AV:A/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N, reflecting attack complexity and required user interaction with limited confidentiality and integrity impact. No known exploits are reported in the wild. Oracle's advisory does not explicitly confirm patch availability for this specific vulnerability but strongly recommends applying security patches promptly. The product is not a cloud service.

An attacker with physical access to the communication segment and requiring human interaction can gain unauthorized ability to update, insert, delete, or read some data accessible by Oracle Agile PLM MCAD Connector version 3.6. The impact is limited to confidentiality and integrity with no availability impact. The overall severity is low.

Oracle strongly recommends that customers remain on actively-supported versions and apply security patches without delay. Although no explicit patch for this vulnerability is confirmed in the advisory, applying the latest Critical Security Patch Update is advised to address this and other vulnerabilities. There is no indication that no action is required or that the issue is already mitigated. Users should verify patch availability via Oracle's official security alerts and apply updates accordingly.