Agile Plm Mcad Connector
Monthly
Full system takeover in Oracle Agile PLM MCAD Connector 3.6 is achievable by a low-privileged network attacker via HTTP, resulting in complete compromise of confidentiality, integrity, and availability of the connector. The vulnerability resides in the CAX Client component and carries a CVSS 3.1 score of 7.5, moderated by high attack complexity. No public exploit code and no CISA KEV listing have been identified at time of analysis, suggesting this is not currently under active widespread exploitation.
Full system takeover of Oracle Agile PLM MCAD Connector 3.6 is achievable by unauthenticated network attackers over HTTP, with successful exploitation yielding complete compromise of confidentiality, integrity, and availability. The flaw resides specifically in the CAX Client component of Oracle's Supply Chain suite and carries a CVSS 3.1 base score of 8.1 (High), moderated by high attack complexity (AC:H). No public exploit code or CISA KEV listing has been identified at time of analysis.
Full takeover of Oracle Agile PLM MCAD Connector 3.6 is achievable by a low-privileged network attacker targeting the CAX Client component over HTTP. Oracle's own advisory characterizes this as 'easily exploitable,' consistent with the CVSS vector showing no attack complexity and no user interaction required. No public exploit code or CISA KEV listing exists at time of analysis, but the combination of high-impact metrics and Oracle's 'easily exploitable' classification makes this a serious priority for affected Supply Chain environments.
Local information disclosure in Oracle Agile PLM MCAD Connector 3.6 exposes a subset of PLM-accessible data to unauthenticated local attackers exploiting an authentication bypass in the CAX Client component. Exploitation is gated by two significant constraints: the attacker must have local logon access to the infrastructure hosting the connector, and a separate legitimate user must interact with the application during the attack window. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis, consistent with the low CVSS 3.1 base score of 3.3.
Unauthorized data disclosure in Oracle Agile PLM MCAD Connector 3.6 allows a low-privileged network attacker to gain complete read access to all data accessible by the CAX Client component via a complex HTTP-based attack requiring victim user interaction. The vulnerability is tagged as an authentication bypass, suggesting the CAX Client component fails to enforce authorization boundaries for a subset of data operations when specific, difficult-to-reproduce conditions are met. No public exploit code or CISA KEV listing exists at time of analysis, and the high attack complexity meaningfully limits opportunistic exploitation.
Unauthorized data read in Oracle Agile PLM MCAD Connector 3.6 exposes a subset of PLM-accessible data to unauthenticated remote attackers via HTTP against the CAX Client component. Tagged explicitly as an Authentication Bypass, the flaw allows any network-reachable attacker to query protected PLM data without credentials, indicating that the CAX Client HTTP interface fails to enforce authentication on at least one data-serving endpoint. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the trivially low attack complexity (AV:N/AC:L/PR:N/UI:N) means exploitation requires no special tooling.
Limited confidentiality exposure in Oracle Agile PLM MCAD Connector 3.6 allows a high-privileged local attacker to read a subset of accessible data under constrained conditions. The CVSS 3.1 base score of 1.8 reflects a worst-case scenario requiring local infrastructure access, high privileges, high attack complexity, and mandatory third-party human interaction - a combination rarely satisfied in practice. No public exploit code and no CISA KEV listing have been identified at time of analysis; real-world risk is negligible for organizations maintaining least-privilege controls on the host infrastructure.
Local information disclosure in Oracle Agile PLM MCAD Connector version 3.6 allows a low-privileged, locally authenticated attacker to read a subset of data accessible to the CAX Client component under high-complexity exploitation conditions. Reported by Oracle Security (secalert_us@oracle.com) as part of the August 2026 Critical Patch Update and tracked under ENISA EUVD-2026-62027, this vulnerability carries a CVSS 3.1 base score of 2.5, reflecting strictly limited confidentiality impact with no integrity or availability consequences. No public exploit code has been identified at time of analysis, and active exploitation has not been confirmed.
Local integrity compromise in Oracle Agile PLM MCAD Connector 3.6 (CAX Client component) requires an attacker with high privileges and physical or logical logon access to the host infrastructure, under high-complexity conditions, to perform unauthorized data modification against accessible records. The attack yields only limited integrity impact - no confidentiality or availability loss - and no public exploit code or active exploitation has been identified at time of analysis. Notably, the 'Authentication Bypass' tag applied by the reporter conflicts with the PR:H CVSS vector, and this discrepancy is unresolved by available data.
Limited data exposure in Oracle Agile PLM MCAD Connector version 3.6 allows an unauthenticated attacker with access to the same physical network segment as the target host to partially read and modify application data. Exploitation is constrained by adjacent-only network access, high attack complexity, and a mandatory human-interaction requirement, resulting in a low CVSS 3.1 base score of 3.7. No public exploit code or active exploitation has been identified at time of analysis.
Oracle Agile PLM MCAD Connector version 3.6 exposes a local, privilege-dependent attack path through its CAX Client component, enabling a low-privileged authenticated local attacker to partially compromise data confidentiality, integrity, and availability within the PLM environment. Exploitation is constrained by a mandatory human-interaction requirement and high attack complexity, making opportunistic or remote exploitation infeasible. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog; the vendor-assigned CVSS 3.1 score of 4.2 reflects the limited blast radius.
Confidentiality compromise in Oracle Agile PLM MCAD Connector 3.6 (CAX Client component) allows an unauthenticated attacker with physical access to the local network segment to gain unauthorized access to all data accessible by the connector. The attack is adjacent-network and high-complexity, limiting realistic exposure to insider threats or attackers with pre-existing physical network presence. No public exploit code exists and no active exploitation has been confirmed; CVSS 5.3 reflects the constrained attack vector. The 'Authentication Bypass' tag suggests the vulnerability circumvents a credential or session-validation mechanism within the CAX Client, enabling direct data exposure without credential theft.
Unauthenticated network access to Oracle Agile PLM MCAD Connector 3.6 exposes a subset of data managed by the CAX Client component over plain HTTP, with no privileges or user interaction required. Classified as an authentication bypass (EUVD-2026-62021) and described as 'easily exploitable' in Oracle's CSPU August 2026 advisory, this vulnerability carries a CVSS 3.1 score of 5.3 with purely confidentiality impact and no integrity or availability risk. No public exploit code or active exploitation has been identified at time of analysis.
Authentication bypass in Oracle Agile PLM MCAD Connector 3.6 (CAX Client component) exposes critical PLM data to unauthenticated attackers who have physical adjacency to the network segment where the connector hardware operates. The vulnerability enables unauthorized read access to all connector-accessible data and limited write access, scored CVSS 5.9 Medium due to the adjacent-network attack vector and high complexity constraints. No public exploit code or CISA KEV listing has been identified at time of analysis.
Local low-privileged access to Oracle Agile PLM MCAD Connector 3.6 enables an authenticated attacker to partially degrade availability of the CAX Client component. Oracle's August 2026 Critical Patch Update (CPU) documents this as easily exploitable by any user with a logon to the host infrastructure, resulting in partial denial of service with no confidentiality or integrity impact. No public exploit identified at time of analysis, and CISA KEV listing is absent, placing this firmly in the low-urgency category.
Partial authentication bypass in Oracle Agile PLM MCAD Connector 3.6 exposes confidentiality and integrity of accessible PLM data to low-privileged adjacent-network attackers. The CAX Client component fails to properly restrict data operations, allowing an attacker on the same physical network segment with low-level credentials to read a subset of accessible records and perform unauthorized insert, update, or delete operations. No public exploit has been identified at time of analysis, and active exploitation has not been confirmed by CISA KEV.
Unauthorized data disclosure in Oracle Agile PLM MCAD Connector 3.6 allows any low-privileged authenticated attacker with HTTP network access to bypass authorization controls in the CAX Client component and read the entire dataset accessible to the connector. The vulnerability is tagged Authentication Bypass, indicating that after obtaining a minimal credential foothold, no additional privilege escalation is needed to access critical PLM data such as engineering designs and product specifications. Oracle's own advisory characterizes the flaw as 'easily exploitable,' and no public exploit code or CISA KEV listing has been identified at time of analysis.
Local exploitation of Oracle Agile PLM MCAD Connector version 3.6 enables an unauthenticated attacker with infrastructure-level logon to partially compromise the CAX Client component, resulting in limited unauthorized read, write, and denial-of-service impact. Exploitation is constrained by both high attack complexity and a mandatory human interaction requirement from a third party, making opportunistic attacks unlikely. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups.
Apache Groovy provides extension methods to aid with creating temporary directories. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.
Full system takeover in Oracle Agile PLM MCAD Connector 3.6 is achievable by a low-privileged network attacker via HTTP, resulting in complete compromise of confidentiality, integrity, and availability of the connector. The vulnerability resides in the CAX Client component and carries a CVSS 3.1 score of 7.5, moderated by high attack complexity. No public exploit code and no CISA KEV listing have been identified at time of analysis, suggesting this is not currently under active widespread exploitation.
Full system takeover of Oracle Agile PLM MCAD Connector 3.6 is achievable by unauthenticated network attackers over HTTP, with successful exploitation yielding complete compromise of confidentiality, integrity, and availability. The flaw resides specifically in the CAX Client component of Oracle's Supply Chain suite and carries a CVSS 3.1 base score of 8.1 (High), moderated by high attack complexity (AC:H). No public exploit code or CISA KEV listing has been identified at time of analysis.
Full takeover of Oracle Agile PLM MCAD Connector 3.6 is achievable by a low-privileged network attacker targeting the CAX Client component over HTTP. Oracle's own advisory characterizes this as 'easily exploitable,' consistent with the CVSS vector showing no attack complexity and no user interaction required. No public exploit code or CISA KEV listing exists at time of analysis, but the combination of high-impact metrics and Oracle's 'easily exploitable' classification makes this a serious priority for affected Supply Chain environments.
Local information disclosure in Oracle Agile PLM MCAD Connector 3.6 exposes a subset of PLM-accessible data to unauthenticated local attackers exploiting an authentication bypass in the CAX Client component. Exploitation is gated by two significant constraints: the attacker must have local logon access to the infrastructure hosting the connector, and a separate legitimate user must interact with the application during the attack window. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis, consistent with the low CVSS 3.1 base score of 3.3.
Unauthorized data disclosure in Oracle Agile PLM MCAD Connector 3.6 allows a low-privileged network attacker to gain complete read access to all data accessible by the CAX Client component via a complex HTTP-based attack requiring victim user interaction. The vulnerability is tagged as an authentication bypass, suggesting the CAX Client component fails to enforce authorization boundaries for a subset of data operations when specific, difficult-to-reproduce conditions are met. No public exploit code or CISA KEV listing exists at time of analysis, and the high attack complexity meaningfully limits opportunistic exploitation.
Unauthorized data read in Oracle Agile PLM MCAD Connector 3.6 exposes a subset of PLM-accessible data to unauthenticated remote attackers via HTTP against the CAX Client component. Tagged explicitly as an Authentication Bypass, the flaw allows any network-reachable attacker to query protected PLM data without credentials, indicating that the CAX Client HTTP interface fails to enforce authentication on at least one data-serving endpoint. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the trivially low attack complexity (AV:N/AC:L/PR:N/UI:N) means exploitation requires no special tooling.
Limited confidentiality exposure in Oracle Agile PLM MCAD Connector 3.6 allows a high-privileged local attacker to read a subset of accessible data under constrained conditions. The CVSS 3.1 base score of 1.8 reflects a worst-case scenario requiring local infrastructure access, high privileges, high attack complexity, and mandatory third-party human interaction - a combination rarely satisfied in practice. No public exploit code and no CISA KEV listing have been identified at time of analysis; real-world risk is negligible for organizations maintaining least-privilege controls on the host infrastructure.
Local information disclosure in Oracle Agile PLM MCAD Connector version 3.6 allows a low-privileged, locally authenticated attacker to read a subset of data accessible to the CAX Client component under high-complexity exploitation conditions. Reported by Oracle Security (secalert_us@oracle.com) as part of the August 2026 Critical Patch Update and tracked under ENISA EUVD-2026-62027, this vulnerability carries a CVSS 3.1 base score of 2.5, reflecting strictly limited confidentiality impact with no integrity or availability consequences. No public exploit code has been identified at time of analysis, and active exploitation has not been confirmed.
Local integrity compromise in Oracle Agile PLM MCAD Connector 3.6 (CAX Client component) requires an attacker with high privileges and physical or logical logon access to the host infrastructure, under high-complexity conditions, to perform unauthorized data modification against accessible records. The attack yields only limited integrity impact - no confidentiality or availability loss - and no public exploit code or active exploitation has been identified at time of analysis. Notably, the 'Authentication Bypass' tag applied by the reporter conflicts with the PR:H CVSS vector, and this discrepancy is unresolved by available data.
Limited data exposure in Oracle Agile PLM MCAD Connector version 3.6 allows an unauthenticated attacker with access to the same physical network segment as the target host to partially read and modify application data. Exploitation is constrained by adjacent-only network access, high attack complexity, and a mandatory human-interaction requirement, resulting in a low CVSS 3.1 base score of 3.7. No public exploit code or active exploitation has been identified at time of analysis.
Oracle Agile PLM MCAD Connector version 3.6 exposes a local, privilege-dependent attack path through its CAX Client component, enabling a low-privileged authenticated local attacker to partially compromise data confidentiality, integrity, and availability within the PLM environment. Exploitation is constrained by a mandatory human-interaction requirement and high attack complexity, making opportunistic or remote exploitation infeasible. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog; the vendor-assigned CVSS 3.1 score of 4.2 reflects the limited blast radius.
Confidentiality compromise in Oracle Agile PLM MCAD Connector 3.6 (CAX Client component) allows an unauthenticated attacker with physical access to the local network segment to gain unauthorized access to all data accessible by the connector. The attack is adjacent-network and high-complexity, limiting realistic exposure to insider threats or attackers with pre-existing physical network presence. No public exploit code exists and no active exploitation has been confirmed; CVSS 5.3 reflects the constrained attack vector. The 'Authentication Bypass' tag suggests the vulnerability circumvents a credential or session-validation mechanism within the CAX Client, enabling direct data exposure without credential theft.
Unauthenticated network access to Oracle Agile PLM MCAD Connector 3.6 exposes a subset of data managed by the CAX Client component over plain HTTP, with no privileges or user interaction required. Classified as an authentication bypass (EUVD-2026-62021) and described as 'easily exploitable' in Oracle's CSPU August 2026 advisory, this vulnerability carries a CVSS 3.1 score of 5.3 with purely confidentiality impact and no integrity or availability risk. No public exploit code or active exploitation has been identified at time of analysis.
Authentication bypass in Oracle Agile PLM MCAD Connector 3.6 (CAX Client component) exposes critical PLM data to unauthenticated attackers who have physical adjacency to the network segment where the connector hardware operates. The vulnerability enables unauthorized read access to all connector-accessible data and limited write access, scored CVSS 5.9 Medium due to the adjacent-network attack vector and high complexity constraints. No public exploit code or CISA KEV listing has been identified at time of analysis.
Local low-privileged access to Oracle Agile PLM MCAD Connector 3.6 enables an authenticated attacker to partially degrade availability of the CAX Client component. Oracle's August 2026 Critical Patch Update (CPU) documents this as easily exploitable by any user with a logon to the host infrastructure, resulting in partial denial of service with no confidentiality or integrity impact. No public exploit identified at time of analysis, and CISA KEV listing is absent, placing this firmly in the low-urgency category.
Partial authentication bypass in Oracle Agile PLM MCAD Connector 3.6 exposes confidentiality and integrity of accessible PLM data to low-privileged adjacent-network attackers. The CAX Client component fails to properly restrict data operations, allowing an attacker on the same physical network segment with low-level credentials to read a subset of accessible records and perform unauthorized insert, update, or delete operations. No public exploit has been identified at time of analysis, and active exploitation has not been confirmed by CISA KEV.
Unauthorized data disclosure in Oracle Agile PLM MCAD Connector 3.6 allows any low-privileged authenticated attacker with HTTP network access to bypass authorization controls in the CAX Client component and read the entire dataset accessible to the connector. The vulnerability is tagged Authentication Bypass, indicating that after obtaining a minimal credential foothold, no additional privilege escalation is needed to access critical PLM data such as engineering designs and product specifications. Oracle's own advisory characterizes the flaw as 'easily exploitable,' and no public exploit code or CISA KEV listing has been identified at time of analysis.
Local exploitation of Oracle Agile PLM MCAD Connector version 3.6 enables an unauthenticated attacker with infrastructure-level logon to partially compromise the CAX Client component, resulting in limited unauthorized read, write, and denial-of-service impact. Exploitation is constrained by both high attack complexity and a mandatory human interaction requirement from a third party, making opportunistic attacks unlikely. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups.
Apache Groovy provides extension methods to aid with creating temporary directories. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.