MCAD Connector EUVD-2026-106124

Exploitation requires the attacker to already hold a low-privileged local logon (PR:L) on the infrastructure where Oracle Agile PLM MCAD Connector 3.6 executes - there is no network vector (AV:L). It additionally depends on interaction from a separate human victim (UI:R), such as a CAD user opening or processing attacker-supplied content, and the flaw is explicitly 'difficult to exploit' (AC:H), implying race conditions, specific state, or precise conditions must be met. These factors - mandatory local access, required second-party user interaction, and high complexity - are the primary limiters that keep realistic risk well below what the 6.7 score alone suggests. Only version 3.6 is stated as affected.

This is a moderate-severity (CVSS 6.7) vulnerability whose real-world risk is meaningfully constrained by its attack prerequisites. The CVSS vector (AV:L/AC:H/PR:L/UI:R) requires local logon access to the host where the MCAD Connector runs, high attack complexity, low-level authentication, and interaction from a victim user other than the attacker - a demanding combination that sharply limits mass exploitation. No EPSS score, CISA KEV listing, or SSVC decision data was supplied, and no public exploit code is referenced; exploitation status is therefore 'no public exploit identified at time of analysis.' Despite full Confidentiality, Integrity, and Availability impact (C:H/I:H/A:H) yielding product takeover, the local+UI+high-complexity gating makes this a targeted, insider-or-foothold scenario rather than a remotely wormable priority. Note a signal conflict worth verifying: the input Tag labels this 'Information Disclosure,' yet the description and CVSS vector indicate full takeover with high integrity and availability impact - the tag understates the actual impact. Overall this is a 'patch in normal cycle' item for the small population of affected deployments rather than an emergency.

A low-privileged user already able to log on to a workstation or server running Oracle Agile PLM MCAD Connector 3.6 plants a malicious file or crafted input, then relies on another legitimate user (e.g., a CAD engineer) to open or process it, triggering the flaw. Because exploitation is difficult (AC:H) and needs that separate human interaction, success is non-trivial, but a successful attack results in complete takeover of the MCAD Connector. No public proof-of-concept exploit is referenced in the available data.