Agile PLM MCAD EUVD-2026-62016

Exploitation requires: (1) physical or logical adjacency to the network segment where the Oracle Agile PLM MCAD Connector 3.6 executes - the attacker must be on the same LAN, VLAN, or broadcast domain as the connector host, ruling out internet-based attackers; (2) a low-privileged account on or authenticated to the MCAD Connector (PR:L per CVSS vector) - unauthenticated exploitation is not indicated by the available data. What limits exploitation: the adjacent-network constraint excludes remote attackers; the low-privilege requirement excludes fully unauthenticated attackers; availability is not impacted, so the vulnerability cannot be used for disruption; and affected data is described as 'some' and 'a subset,' implying partial rather than full data exposure. The 'Authentication Bypass' tag has not been independently corroborated with a CWE or detailed technical description - the exact bypass mechanism within the CAX Client is unconfirmed from available data.

The CVSS 3.1 base score of 4.6 (Medium) accurately reflects the constrained real-world risk. The adjacent attack vector (AV:A) is a significant limiting factor - exploitation requires physical or logical presence on the same network segment as the connector host, which substantially narrows the attacker population in typical enterprise deployments. PR:L further constrains exploitation to accounts that have already obtained some level of access to the system. Impacts are bounded: confidentiality (C:L) and integrity (I:L) are partial, and availability is unaffected (A:N), meaning this vulnerability cannot cause outages or denial-of-service. No EPSS data was provided, and the vulnerability is not listed in CISA KEV, suggesting no confirmed widespread exploitation. The 'Authentication Bypass' tag creates a minor tension with PR:L - if exploitation truly bypasses authentication, PR:N would be expected; the most consistent interpretation is that the bypass is an authorization bypass (privilege escalation within an authenticated session) rather than a full authentication bypass. This distinction should be verified with the Oracle advisory. Overall, this is a genuine but low-priority finding outside of high-value PLM environments handling sensitive design intellectual property.

An attacker with a low-privileged account on the internal engineering VLAN - such as a contractor or insider with limited system access - connects to the CAX Client component over the adjacent network segment and issues crafted data requests that bypass authorization controls. The attacker reads design data or bill-of-materials records they are not entitled to access and makes unauthorized modifications to PLM records, potentially tampering with component specifications. No public exploit code has been identified at time of analysis.