This vulnerability affects Oracle Agile PLM MCAD Connector version 3.6. It allows an unauthenticated attacker who has logon access to the infrastructure hosting the product to compromise it, requiring human interaction from a third party. Successful exploitation results in unauthorized read access to a subset of data accessible by the product. The CVSS 3.1 vector is AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N, indicating local attack vector, low complexity, no privileges required, user interaction required, unchanged scope, and limited confidentiality impact.

The impact is limited to unauthorized read access to some data accessible by Oracle Agile PLM MCAD Connector. There is no impact on integrity or availability. The attack requires local access and user interaction, reducing the likelihood and impact severity.

Oracle has included this vulnerability in its August 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant security patches promptly. Since the vendor advisory does not specify a direct patch for this product version separately, users should consult the Oracle Critical Security Patch Update advisory for patch availability and installation instructions. No alternative mitigations are specified.