CVE-2026-83274 is a vulnerability in Oracle Agile PLM MCAD Connector (component: CAX Client) version 3.6. The flaw allows a low privileged attacker who has logon access to the infrastructure where the product runs to compromise the Oracle Agile PLM MCAD Connector, potentially gaining unauthorized access to critical or all accessible data. The CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, reflecting local attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality impact without integrity or availability impact. Oracle has included a fix for this vulnerability in its September 2026 Critical Security Patch Update.

Successful exploitation of this vulnerability can lead to unauthorized access to critical data or complete access to all data accessible by Oracle Agile PLM MCAD Connector. The confidentiality impact is high, but there is no impact on integrity or availability. The vulnerability requires local access with low privileges and no user interaction, making it exploitable by an authenticated user with limited permissions on the affected system.

Oracle has released a security patch for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers are strongly advised to apply the available patches promptly to remediate this issue. Oracle recommends remaining on actively supported versions and applying security patches without delay. No additional mitigation steps are indicated beyond applying the official patch.