Description

Vulnerability in the Oracle Agile PLM MCAD Connector product of Oracle Supply Chain (component: CAX Client). The supported version that is affected is 3.6. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Agile PLM MCAD Connector executes to compromise Oracle Agile PLM MCAD Connector. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Agile PLM MCAD Connector. CVSS 3.1 Base Score 3.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.3",
  "pubDate": "2026-08-18T21:18:07.273Z",
  "pubdate": "2026-08-18T21:18:07.273Z",
  "executiveSummary": "An easily exploitable vulnerability exists within the Oracle Agile PLM MCAD Connector product, specifically affecting the CAX Client component version 3.6. This security flaw allows a low-privileged attacker with local logon access to the underlying infrastructure where the Oracle Agile PLM MCAD Connector executes to compromise the application.\nThe primary impact of a successful exploitation is limited to a partial denial of service (partial DoS) affecting the availability of the targeted Oracle Agile PLM MCAD Connector instance. Confidentiality and integrity are not impacted by this vulnerability.\nThe attack vector is strictly local, requiring the adversary to possess authenticated interactive or programmatic access to the host operating system infrastructure. No user interaction is required for the execution of the attack. The CVSS 3.1 base score assigned to this vulnerability is 3.3, reflecting the localized nature and limited availability impact of the threat.\nOrganizations utilizing the affected Oracle Agile PLM MCAD Connector version 3.6 face availability risks if malicious actors leverage local execution privileges to disrupt CAX Client operations. Remediation requires applying the vendor-supplied updates or implementing strict host-based access controls to limit unauthorized local execution.",
  "technicalDetails": "The vulnerability resides in the CAX Client component of the Oracle Agile PLM MCAD Connector version 3.6. The architectural design of the affected component fails to adequately handle resource constraints, exception states, or input validation when processing requests locally, leading to destabilization of the service.\nRegarding attack requirements and environment exposure, the vulnerability features a local attack vector (AV:L), low attack complexity (AC:L), and requires low privileges (PR:L). The attack requires no user interaction (UI:N) and has an unchanged scope (S:U). The impact is strictly constrained to availability with a low severity rating (A:L).\nThe step-by-step attack flow begins with the low-privileged attacker establishing a valid logon session on the host infrastructure executing the Oracle Agile PLM MCAD Connector. Leveraging native operating system access, the attacker interacts directly with the vulnerable CAX Client component. By supplying maliciously crafted inputs, triggering specific operational sequences, or resource exhaustion techniques against the local interface, the attacker forces the CAX Client into an unstable state.\nThe resulting payload behavior manifests as an application crash, resource starvation, or process termination, which successfully denies legitimate users access to the CAX Client functionality. Because the vulnerability is confined to the local execution environment, network-based exploitation vectors are not applicable, and post-exploitation impact remains restricted to localized availability degradation rather than remote code execution or privilege escalation."
}