A vulnerability in Oracle Agile PLM MCAD Connector version 3.6 allows a low privileged attacker with logon access to compromise the product. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data and unauthorized read access to some data. The vulnerability has a CVSS 3.1 base score of 7.3, indicating high severity with confidentiality and integrity impacts. Oracle has released security patches addressing this and many other vulnerabilities in their September 2026 Critical Security Patch Update.