This vulnerability affects Oracle Agile PLM MCAD Connector version 3.6 and allows a high privileged attacker with logon access to the infrastructure where the product runs to compromise it. Exploitation requires human interaction from a person other than the attacker. The impact is limited to unauthorized read access to a subset of data accessible by the product. The CVSS 3.1 base score is 1.8, reflecting low confidentiality impact and no integrity or availability impact. The attack vector is local, with high attack complexity and requiring user interaction.

An attacker with high privileges on the infrastructure and the ability to interact with another user can gain unauthorized read access to some data accessible by Oracle Agile PLM MCAD Connector. There is no impact on data integrity or availability.

Oracle has not explicitly provided a patch or fix for this vulnerability in the advisory. Patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for current remediation guidance. Oracle strongly recommends applying all relevant security patches promptly and remaining on actively supported versions to mitigate exploitation risks.