This vulnerability affects Oracle Agile PLM MCAD Connector version 3.6 and involves a security flaw that can be exploited remotely over HTTP by a low privileged attacker. Successful exploitation requires user interaction from a third party. The impact is unauthorized access to critical or all accessible data within the Oracle Agile PLM MCAD Connector. The CVSS 3.1 vector indicates network attack vector, high attack complexity, low privileges required, user interaction required, unchanged scope, and high confidentiality impact without integrity or availability impact.

Successful exploitation can lead to unauthorized access to critical or all data accessible by Oracle Agile PLM MCAD Connector, compromising confidentiality. There is no reported impact on data integrity or system availability. The attack requires human interaction and is difficult to exploit, limiting the likelihood of widespread exploitation.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability among many others. Customers are strongly advised to apply the available security patches promptly and remain on actively supported versions. No indication of 'no action required' or 'already mitigated' was provided, so patching is the recommended mitigation. Since this is not a cloud service, remediation depends on customer application of patches.