This vulnerability affects Oracle Agile PLM MCAD Connector version 3.6 and allows a low privileged attacker who has logon access to the infrastructure where the product executes to compromise it. The scope of impact may extend to additional Oracle products. Successful exploitation can result in unauthorized creation, deletion, or modification of critical data and unauthorized read access to some data. The CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N, reflecting local attack vector, low complexity, low privileges required, no user interaction, scope change, low confidentiality impact, high integrity impact, and no availability impact. Oracle has included a fix for this vulnerability in their September 2026 Critical Security Patch Update.

The vulnerability enables unauthorized creation, deletion, or modification of critical data within Oracle Agile PLM MCAD Connector and unauthorized read access to some data. The scope change indicates that other Oracle products may also be impacted indirectly. The confidentiality impact is low, but the integrity impact is high, potentially compromising data trustworthiness. Availability is not affected.

Oracle has released a security patch addressing this vulnerability as part of the September 2026 Critical Security Patch Update. Customers using Oracle Agile PLM MCAD Connector version 3.6 should apply the available patch without delay. Oracle strongly recommends remaining on actively supported versions and promptly applying security patches to mitigate exploitation risks.