Description

Vulnerability in the Oracle Agile PLM MCAD Connector product of Oracle Supply Chain (component: CAX Client). The supported version that is affected is 3.6. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Agile PLM MCAD Connector executes to compromise Oracle Agile PLM MCAD Connector. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Agile PLM MCAD Connector accessible data. CVSS 3.1 Base Score 1.9 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "1.9",
  "pubDate": "2026-08-18T21:18:08.290Z",
  "pubdate": "2026-08-18T21:18:08.290Z",
  "executiveSummary": "A vulnerability has been identified in the Oracle Agile PLM MCAD Connector product, specifically within the CAX Client component version 3.6, affecting Oracle Supply Chain. This security flaw is classified as a difficult-to-exploit vulnerability that allows a highly privileged attacker with local interactive logon access to the underlying infrastructure where the Oracle Agile PLM MCAD Connector executes to compromise the application. Successful exploitation of this vulnerability directly impacts data integrity, resulting in unauthorized update, insert, or delete access to a subset of data accessible by the Oracle Agile PLM MCAD Connector. The associated CVSS 3.1 Base Score is 1.9, reflecting limited integrity impacts under constrained conditions. The attack vector is localized (AV:L), requiring high privileges (PR:H) and high attack complexity (AC:H), with no user interaction required (UI:N) and no impact on scope (S:U), confidentiality, or availability. Risk implications are primarily centered around unauthorized data modification within the PLM environment by actors who have already achieved significant administrative or high-privilege access to the host infrastructure. Defensive strategies must focus on strict host-based access controls and least-privilege enforcement to prevent escalation or abuse of local execution contexts.",
  "technicalDetails": "The vulnerability resides within the CAX Client component of the Oracle Agile PLM MCAD Connector version 3.6. The root cause stems from insufficient access controls, validation, or privilege separation within the execution context of the affected component, allowing locally processed operations to manipulate data stores without adequate authorization checks when specific high-privilege conditions are met. Exploitation requires the adversary to already possess high privileges on the host system and interactive logon capabilities to the infrastructure where the Oracle Agile PLM MCAD Connector executes. Because the attack vector is local (AV:L) and features high attack complexity (AC:H), the attacker must bypass or navigate stringent local security barriers, environmental hardening, or race conditions to successfully interact with the vulnerable CAX Client execution flow. The attack flow commences with the high-privileged threat actor establishing a local session on the target infrastructure. From this authenticated local context, the attacker leverages their elevated privileges to manipulate the runtime environment, execution parameters, or local IPC mechanisms utilized by the CAX Client component of the Oracle Agile PLM MCAD Connector. By carefully orchestrating the attack conditions to meet the high complexity threshold, the threat actor forces the CAX Client to execute unauthorized logic or process manipulated inputs. The payload behavior during a successful exploitation scenario manifests as unauthorized database or file-system transactions, specifically resulting in unauthorized update, insert, or delete operations targeting data accessible to the Oracle Agile PLM MCAD Connector. The post-exploitation impact is strictly confined to data integrity degradation within the scope of the affected application data stores, as confidentiality and availability metrics remain unaffected (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N). Network exposure is negligible due to the local attack vector requirement, placing the burden of mitigation heavily on host-based integrity monitoring, rigorous privilege management, and adherence to the principle of least privilege for all administrative accounts interacting with the infrastructure hosting the Oracle Agile PLM MCAD Connector."
}