This vulnerability affects Oracle Agile PLM MCAD Connector version 3.6, specifically the CAX Client component. It allows a low privileged attacker who can log on to the infrastructure where the product runs to compromise the Oracle Agile PLM MCAD Connector. The impact is unauthorized access to critical or all data accessible by the product. The CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, indicating local attack vector, low complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality impact without integrity or availability impact. Oracle has addressed this vulnerability in their September 2026 Critical Security Patch Update, which includes patches for Oracle Agile PLM MCAD Connector version 3.6.

An attacker with low privileges and logon access to the affected infrastructure can gain unauthorized access to critical or all data accessible by Oracle Agile PLM MCAD Connector version 3.6. This compromises confidentiality but does not affect integrity or availability. The vulnerability is rated medium severity with a CVSS score of 5.5.

Oracle has released a security patch for Oracle Agile PLM MCAD Connector version 3.6 as part of the September 2026 Critical Security Patch Update. Customers are strongly advised to apply the available patches promptly to remediate this vulnerability. Remaining on actively supported versions and timely patching are critical to prevent exploitation.