A flaw in the Oracle Agile PLM MCAD Connector’s CAX Client component permits a low‑privileged local user to compromise the connector. The weakness allows the attacker to bypass necessary checks after authenticating to the underlying infrastructure. Successful exploitation requires obtaining or leveraging the credentials of another user and a human interaction from that user, making it difficult to execute without social engineering. When the exploit succeeds, the attacker can gain full control over the connector, impacting confidentiality, integrity, and availability.

Oracle Corporation’s Oracle Agile PLM MCAD Connector product, version 3.6, which is part of Oracle Supply Chain Management. The affected component is the CAX Client of the connector.

The CVSS score of 6.7 indicates moderate severity with complete disruption to confidentiality, integrity, and availability when compromised. The exploit vector is local, but requires a high effort (AC:H) and the user interface element (UI:R) meaning that a human interaction from someone else is needed, typically through social engineering or credential theft. The EPSS score is <1%, implying a very low probability that the vulnerability will be exploited in the wild, and it is not listed in the CISA KEV catalog. The local attack requires a low‑privileged user to be present on the host, but human interaction from another user is needed to launch the exploit.