This vulnerability affects Oracle Agile PLM MCAD Connector version 3.6, specifically in the CAX Client component. An unauthenticated attacker with network access via HTTP can exploit this flaw to obtain unauthorized read access to a subset of accessible data. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and limited confidentiality impact. Oracle's August 2026 Critical Security Patch Update advisory references this vulnerability among many others but does not explicitly state a patch for version 3.6 of this product. The vulnerability is classified under CWE-200 (Exposure of Sensitive Information).

Successful exploitation results in unauthorized read access to some data within Oracle Agile PLM MCAD Connector version 3.6. There is no impact on data integrity or availability. The confidentiality impact is limited, as reflected by the CVSS score of 5.3.

Oracle strongly recommends applying security patches promptly as part of their Critical Security Patch Update program. However, the vendor advisory does not explicitly confirm a patch for Oracle Agile PLM MCAD Connector version 3.6. Therefore, patch status is not yet confirmed—check the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for the latest remediation guidance. Customers should remain on actively supported versions and apply any available patches without delay.