A vulnerability exists in Oracle Agile PLM MCAD Connector version 3.6 that allows a low privileged attacker with logon access to the infrastructure to compromise the product. The vulnerability can lead to unauthorized access to critical data or complete access to all data accessible by Oracle Agile PLM MCAD Connector. The CVSS 3.1 base score is 5.5, indicating a medium severity with high confidentiality impact but no impact on integrity or availability. Oracle has released a Critical Security Patch Update in September 2026 addressing this and other vulnerabilities.