CVE-2026-71066 in Agile PLM MCAD Connector
Summary
by MITRE • 08/19/2026
Vulnerability in the Oracle Agile PLM MCAD Connector product of Oracle Supply Chain (component: CAX Client). The supported version that is affected is 3.6. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Agile PLM MCAD Connector executes to compromise Oracle Agile PLM MCAD Connector. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Agile PLM MCAD Connector accessible data as well as unauthorized read access to a subset of Oracle Agile PLM MCAD Connector accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Agile PLM MCAD Connector. CVSS 3.1 Base Score 4.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/19/2026
The vulnerability identified in the Oracle Agile PLM MCAD Connector product represents a significant security flaw within the component known as CAX Client, specifically affecting version 3.6 of this integration tool used with Oracle Supply Chain applications. This software serves as a bridge between Oracle Agile Product Lifecycle Management and CAD systems, facilitating data exchange for engineering change orders and design modifications. The core issue lies in an access control mechanism that fails to properly enforce authentication requirements on specific endpoints or operations within the CAX Client interface. Although the vulnerability is classified as difficult to exploit due to high complexity factors, it allows unauthenticated attackers who have already gained logon access to the underlying infrastructure where the connector executes to compromise the integrity and confidentiality of the system. This distinction between network-level accessibility and application-level authentication is critical; while an attacker must first obtain valid credentials or shell access on the host machine running the service, once inside that perimeter, they can bypass further authorization checks within the application logic itself.
From a technical perspective, this flaw aligns with CWE-269, which describes Improper Privilege Management, and more specifically points toward issues related to insufficient verification of user privileges before performing sensitive operations. The attacker does not need complex exploitation techniques such as buffer overflows or memory corruption; instead, the vulnerability relies on logical flaws in how the application validates session tokens or request parameters after initial authentication has occurred elsewhere in the infrastructure chain. Because the attack requires human interaction from a person other than the primary attacker, it suggests that social engineering may be involved to trigger specific actions within the CAX Client interface, such as clicking a malicious link or approving a fraudulent change order. This requirement for user interaction places the vulnerability under ATT&CK technique T1566.002, which covers Spearphishing Link attacks, indicating that while the technical exploit is straightforward, its successful execution depends heavily on manipulating end-users to initiate the compromised state within the application layer.
The operational impact of this vulnerability is multifaceted, affecting confidentiality, integrity, and availability with a CVSS 3.1 Base Score of 4.5, categorized as Medium severity. The vector string (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L) confirms that the attack requires local network access or prior infrastructure compromise but no initial privileges within the application itself. Once exploited, an attacker can perform unauthorized updates, inserts, or deletes against accessible data managed by Oracle Agile PLM MCAD Connector. This means critical engineering change orders, part numbers, and design specifications could be altered, deleted, or fabricated without proper authorization. Such integrity violations pose a severe risk to manufacturing operations, potentially leading to the production of defective parts, supply chain disruptions, or intellectual property theft if sensitive design data is exfiltrated through unauthorized read access capabilities.
Furthermore, the vulnerability allows for partial denial of service conditions against the Oracle Agile PLM MCAD Connector itself. While this does not necessarily crash the entire enterprise system, it can disrupt specific workflows related to CAD integration, causing delays in product development cycles and engineering approvals. For organizations relying on real-time synchronization between their PLM systems and design tools, even a partial outage can have cascading effects on project timelines and resource allocation. The combination of data manipulation capabilities and service disruption makes this vulnerability particularly dangerous for environments where strict change management protocols are enforced to maintain regulatory compliance and product quality standards.
Mitigation strategies must focus on both technical controls and procedural safeguards. Since the attack vector requires an attacker to have logon access to the infrastructure, robust host-based security measures are essential. This includes implementing strict network segmentation to isolate systems running Oracle Agile PLM MCAD Connector from general user workstations where social engineering attacks typically originate. Additionally, enforcing multi-factor authentication for all administrative and service accounts reduces the likelihood of initial credential compromise that leads to this vulnerability's exploitation. On the application level, Oracle should be consulted for any available patches or configuration updates that address the CAX Client authorization logic. Organizations must also review their change management processes to ensure that human interaction steps within the PLM workflow include verification mechanisms that can detect anomalous activity originating from compromised accounts. Regular auditing of access logs and monitoring for unusual patterns in data modification requests will help identify potential exploitation attempts early, limiting the scope of any unauthorized changes or data exfiltration before significant damage occurs.