## Summary
CVE-2026-83277 is a vulnerability in Oracle Agile PLM MCAD Connector (component: CAX Client) within Oracle Supply Chain. The affected supported version is 3.6, and exploitation is described as easily exploitable by a low-privileged attacker with logon to the infrastructure where the connector executes.
Successful exploitation may enable unauthorized creation, deletion, or modification of critical data (and unauthorized read access to a subset of data accessible to the connector), with confidentiality and integrity impacts (CVSS 3.1 base score 7.3).
## Technical Details
- Affected component: CAX Client (Oracle Agile PLM MCAD Connector)
- Attack vector: LOCAL
- Privileges required: PR:L (low privileges)
- User interaction: UI:N (no user interaction)
- Confidentiality impact: C:L
- Integrity impact: I:H
- Availability impact: A:N
## Affected
- Oracle Agile PLM MCAD Connector (Oracle Supply Chain), affected supported version: 3.6
## Impact
- Unauthorized creation, deletion, or modification of critical data within Oracle Agile PLM MCAD Connector accessible data
- Unauthorized read access to a subset of Oracle Agile PLM MCAD Connector accessible data
- Potential scope change: attacks may significantly impact additional products beyond the connector
## Mitigation
1. Patch immediately: apply the vendor’s fix for Oracle Agile PLM MCAD Connector 3.6 (exact fixed version not provided in the available material).
2. Restrict access to the host(s) where the connector and CAX Client run to reduce the likelihood of a low-privileged logged-in attacker.
3. Monitor for suspicious activity consistent with unauthorized data operations against connector-accessible datasets (specific detection indicators not provided in the available material).
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N