The Oracle Agile PLM MCAD Connector 3.6 contains an unauthenticated HTTP vulnerability that enables an attacker with network access to read a subset of data. Successful exploitation results in unauthorized read access to a limited portion of the connector’s accessible data, causing partial disclosure of confidential information. The flaw is mapped to authentication bypass and unauthorized data disclosure weaknesses, with a CVSS 3.1 base score of 5.3 reflecting a confidentiality impact.

Affected product is Oracle Agile PLM MCAD Connector from Oracle Corporation, version 3.6. This is the only version listed as vulnerable.

The vulnerability is a moderate-risk flaw with a CVSS score of 5.3 and the attack vector is unauthenticated HTTP. The EPSS score is < 1%, indicating a low likelihood of exploitation in the wild. It is not listed in CISA KEV, so no mass exploitation has been reported. Nevertheless, because no authentication is required and the attack occurs over HTTP, an unauthenticated attacker on the network could potentially read data if the connector is exposed. Organizations running the affected connector should consider the risk of data leakage until a fix is applied.