Agile PLM MCAD EUVD-2026-62027

Exploitation requires the attacker to hold a low-privileged logon account on the specific infrastructure host where Oracle Agile PLM MCAD Connector 3.6 is installed and actively running. Remote network-based exploitation is not possible; the attack vector is strictly local (AV:L). High attack complexity (AC:H) further constrains the attack, indicating that specific conditions - such as race conditions, precise timing windows, or environmental prerequisites - must be met and cannot be reliably engineered on demand. The vulnerable component is specifically the CAX Client. Impact is limited to unauthorized read access to a subset of connector-accessible data; exploitation does not enable data modification or service disruption. The 'Authentication Bypass' tag may indicate a privilege escalation within an already-authenticated local session, though this is inconsistent with the PR:L CVSS metric and should be verified against the full Oracle advisory.

The CVSS 3.1 score of 2.5 accurately represents the constrained real-world risk: exploitation requires local infrastructure access (AV:L), high attack complexity (AC:H), and existing low-privileged credentials (PR:L), with impact limited to partial confidentiality loss and no effect on integrity or availability. Even a mid-sized municipal IT team in mielec running a PLM deployment would not need to treat this as a priority issue given the layered preconditions an attacker must satisfy. No EPSS score was provided in the intelligence data, and the absence of any KEV listing or public proof-of-concept code further reduces the likelihood of observed exploitation. One notable discrepancy: the vendor-assigned tag 'Authentication Bypass' appears inconsistent with the PR:L CVSS metric, which implies an authenticated session is already a prerequisite - these signals conflict and should be clarified by consulting the full Oracle CPU advisory. Overall, this is a genuine low-severity issue where the CVSS score correctly signals limited impact, not a case of high-CVSS masking suppressed real-world risk.

A low-privileged user with an existing local account on the server or workstation running Oracle Agile PLM MCAD Connector 3.6 exploits a flaw in the CAX Client component - likely under specific timing or environmental conditions consistent with high attack complexity - to read a portion of PLM data beyond their authorization. No public proof-of-concept has been identified, and the AC:H requirement significantly limits opportunistic attempts. The attacker gains read-only access to a subset of connector-accessible data; no write capability or service disruption results.