Oracle Agile PLM MCAD Connector EUVD-2026-62011

The attacker must have local logon access to the specific infrastructure host where Oracle Agile PLM MCAD Connector 3.6 and its CAX Client component are installed - remote network exploitation is not possible given AV:L. Beyond infrastructure access, exploitation requires high attack complexity (AC:H), meaning precise conditions or timing must be met. Critically, a human user other than the attacker must interact with the application (UI:R) for the exploit to succeed, which requires social engineering or waiting for routine user activity. Exploitation is further limited to environments running exactly version 3.6 of the MCAD Connector. Oracle has not disclosed what specific configuration or feature triggers the vulnerability, so no configuration-level workaround can be precisely targeted. The specific nature of the required user interaction is not described in available data.

The CVSS 3.1 base score of 4.5 Medium is consistent with the constrained attack surface: AV:L limits the attacker to the same host or infrastructure where the CAX Client runs, AC:H signals that exploitation is non-trivial and requires specific conditions to align, UI:R means a legitimate user must take some action for the attack to succeed, and all three impact metrics are low (C:L/I:L/A:L), indicating only partial compromise. No EPSS score was provided in the available intelligence, so probabilistic exploitation likelihood cannot be quantified. The vulnerability is absent from the CISA KEV catalog and no proof-of-concept code has been identified, which aligns with the low CVSS score and local-only vector - this is not the profile of a flaw attracting widespread attacker interest. The combination of these signals places this firmly in the lower-priority tier for most organizations; even a small IT team managing a modest PLM deployment should treat this as a routine patch-cycle item rather than an emergency response, because the local-access prerequisite and required human interaction substantially limit realistic attacker leverage.

An attacker who has already obtained local logon access to the infrastructure host running the CAX Client - for example, a malicious insider or an attacker who has previously compromised a workstation - crafts conditions that require a legitimate user to interact with the CAX Client application, triggering the underlying flaw. The result is limited unauthorized access to or modification of PLM-accessible data, or a partial disruption of the CAX Client service. No proof-of-concept code exists at time of analysis, making this scenario primarily a theoretical insider-threat vector.