CVE-2026-71067 in Agile PLM MCAD Connector
Summary
by MITRE • 08/19/2026
Vulnerability in the Oracle Agile PLM MCAD Connector product of Oracle Supply Chain (component: CAX Client). The supported version that is affected is 3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM MCAD Connector. Successful attacks of this vulnerability can result in takeover of Oracle Agile PLM MCAD Connector. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/19/2026
The Oracle Agile PLM MCAD Connector, a component within the broader Oracle Supply Chain Management suite, has been identified with a critical security flaw in version 3.6 affecting the CAX Client module. This vulnerability represents a significant risk to organizations relying on this software for product lifecycle management and manufacturing data integration. The core issue stems from insufficient input validation or access control mechanisms within the HTTP interface of the CAX Client component, allowing an attacker with low privileges to execute unauthorized actions that compromise the integrity and confidentiality of the system.
From a technical perspective, the flaw enables remote code execution or privilege escalation through standard web protocols without requiring user interaction. The attack vector is classified as network-accessible via HTTP, meaning it can be exploited over local area networks or potentially across wider internet connections depending on deployment configurations. Because the vulnerability requires only low-privileged access to initiate an exploit, internal threats such as compromised workstation accounts or malicious insiders pose a substantial risk. Once triggered, the attacker gains full control over the Oracle Agile PLM MCAD Connector environment, effectively achieving system takeover. This level of compromise allows for arbitrary command execution, data exfiltration, and modification of critical product design files stored within the platform.
The operational impact of this vulnerability is severe, reflected in its CVSS 3.1 base score of 8.8 out of 10. The vector string (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates high impacts across all three pillars of the CIA triad: confidentiality, integrity, and availability. An attacker can read sensitive intellectual property such as CAD models and engineering specifications, alter design parameters to introduce defects or sabotage products, and disrupt manufacturing operations by rendering the system unavailable. In a supply chain context, this could lead to production halts, financial loss, and reputational damage due to compromised product quality data.
This vulnerability aligns with CWE-269 Improper Privilege Management and potentially CWE-78 OS Command Injection if arbitrary commands are executed on the underlying operating system. From an adversary perspective, it facilitates initial access and lateral movement within enterprise networks, mapping closely to MITRE ATT&CK techniques such as T1059 Command and Scripting Interpreter or T1068 Exploitation for Privilege Escalation depending on the specific exploitation method utilized by threat actors. The lack of user interface requirements makes it particularly dangerous against automated scanning tools used in reconnaissance phases.
Mitigation strategies must prioritize immediate patching to the latest supported version released by Oracle, which addresses the underlying code flaws in the CAX Client component. Organizations should also implement network segmentation to restrict HTTP access to the MCAD Connector from untrusted zones and enforce strict firewall rules limiting inbound traffic to authorized IP ranges only. Additionally, deploying Web Application Firewalls with specific rule sets for this application can help detect and block exploit attempts before they reach the vulnerable service. Regular vulnerability assessments and penetration testing should be conducted to identify similar misconfigurations in other connected systems within the supply chain ecosystem.