CVE-2026-101723 in Agile PLM MCAD Connector
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle Agile PLM MCAD Connector product of Oracle Supply Chain (component: CAX Client). The supported version that is affected is 3.6. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Agile PLM MCAD Connector executes to compromise Oracle Agile PLM MCAD Connector. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Agile PLM MCAD Connector. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the CAX Client component of the Oracle Agile PLM MCAD Connector, a critical integration tool used to synchronize product lifecycle management data with computer-aided design environments. This specific flaw affects version 3.6 and represents a significant risk to organizations relying on this connector for engineering change orders and CAD file synchronization. The vulnerability is characterized by its complexity; it requires an attacker who has already gained low-level privileged access to the infrastructure hosting the Oracle Agile PLM MCAD Connector service. Furthermore, exploitation is not fully automated as it demands human interaction from a user other than the initial attacker, suggesting that the exploit likely involves social engineering or manipulation of legitimate workflows within the application interface.
From a technical perspective, this vulnerability aligns with CWE-20 Improper Input Validation and potentially CWE-79 Cross-site Scripting if the vector involves web-based interactions, although the specific mechanism is not detailed in the advisory. The requirement for low privileges indicates that the attacker does not need administrative rights to initiate the attack sequence, which lowers the barrier to entry significantly once initial access is established. However, the high complexity and the necessity for user interaction serve as natural mitigating factors that reduce the likelihood of successful exploitation by opportunistic attackers. Despite these constraints, the potential impact remains severe because a successful compromise leads to complete takeover of the Oracle Agile PLM MCAD Connector process. This level of control allows an adversary to manipulate engineering data, inject malicious CAD files, or exfiltrate sensitive intellectual property stored within the Product Lifecycle Management system.
The operational impact of this vulnerability is substantial due to its effect on confidentiality, integrity, and availability as reflected in the CVSS 3.1 base score of 6.7. The vector string AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H confirms that while access requirements are restrictive, the consequences of a breach are critical across all security triads. An attacker could alter design specifications leading to manufacturing defects or safety hazards (Integrity), steal proprietary designs and trade secrets (Confidentiality), or disrupt production workflows by corrupting data synchronization processes (Availability). In an industrial context where Agile PLM is often integrated with ERP systems, such a compromise can have cascading effects on supply chain operations.
To mitigate this risk, organizations should prioritize patching the Oracle Agile PLM MCAD Connector to the latest available version that addresses this flaw in the CAX Client component. Since exploitation requires low-privileged access and human interaction, strict adherence to least privilege principles is essential. Administrators should ensure that service accounts running the connector have only the minimum permissions necessary for operation and are isolated from general user networks. Additionally, implementing robust network segmentation can limit lateral movement opportunities for attackers who may have compromised other parts of the infrastructure. Security awareness training focused on identifying suspicious requests or unusual file operations within PLM interfaces is also recommended to counteract the human interaction requirement inherent in this attack vector. Monitoring logs for anomalous activities related to CAD data imports and synchronization events can provide early detection indicators aligned with ATT&CK techniques involving input validation bypasses and application layer attacks.