This vulnerability affects Oracle Agile PLM MCAD Connector version 3.6, specifically the CAX Client component. It allows an attacker with low privileges and logon access to the infrastructure where the product runs to compromise the product, resulting in unauthorized access to critical or all accessible data. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) indicates local attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality impact without integrity or availability impact. Oracle has published a Critical Security Patch Update in September 2026 that includes a fix for this vulnerability.

An attacker with low privileges and logon access to the affected infrastructure can exploit this vulnerability to gain unauthorized access to critical data or potentially all data accessible by Oracle Agile PLM MCAD Connector. The impact is limited to confidentiality, with no reported integrity or availability effects.

Oracle has released a security patch for this vulnerability as part of the September 2026 Critical Security Patch Update. Users of Oracle Agile PLM MCAD Connector version 3.6 should apply the relevant patch promptly to remediate this vulnerability. Oracle strongly recommends staying on actively supported versions and applying security patches without delay to prevent exploitation.