CVE-2026-71069 in Agile PLM MCAD Connector
Summary
by MITRE • 08/19/2026
Vulnerability in the Oracle Agile PLM MCAD Connector product of Oracle Supply Chain (component: CAX Client). The supported version that is affected is 3.6. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM MCAD Connector. Successful attacks of this vulnerability can result in takeover of Oracle Agile PLM MCAD Connector. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/19/2026
The Oracle Agile PLM MCAD Connector version 3.6 contains a critical security flaw within the CAX Client component that allows for unauthorized system compromise under specific conditions. This vulnerability is classified as difficult to exploit, indicating a high complexity requirement for an attacker to successfully leverage it in practice. Despite this difficulty, the potential impact of a successful exploitation is severe, granting the attacker complete control over the affected Oracle Agile PLM MCAD Connector instance. The attack vector requires network access via HTTP and low-privileged user credentials, meaning that any authenticated user with minimal permissions on the system can potentially trigger the flaw without needing additional social engineering or physical proximity.
From a technical perspective, this vulnerability aligns with CWE-269 Improper Privilege Management, as it allows an actor with lower privileges to escalate their access level significantly beyond what is intended by the application's security model. The ability of a low privileged attacker to take over the system suggests that there are likely insufficient checks on user roles or permissions when handling certain HTTP requests processed by the CAX Client component. This could involve improper validation of input parameters, lack of proper authorization checks for administrative functions exposed through the web interface, or insecure direct object references that allow manipulation of backend processes. The use of HTTP rather than HTTPS further exacerbates the risk, as traffic may be susceptible to interception if not properly secured at a network level, although the primary flaw lies within the application logic itself.
The operational impact of this vulnerability is substantial, corresponding to a CVSS 3.1 Base Score of 7.5 which indicates High severity. The vector string (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms that the attack has Network accessibility but requires High complexity and Low privileges, yet results in High impacts on Confidentiality, Integrity, and Availability. This means a successful exploit could lead to full system takeover, allowing an attacker to read sensitive product lifecycle management data, modify critical configuration files or database entries, and disrupt service availability for other users of the Oracle Supply Chain platform. Such compromise undermines the integrity of engineering change orders, bill-of-materials structures, and other core PLM functionalities that rely on accurate and secure data handling.
In terms of threat modeling, this vulnerability maps to MITRE ATT&CK techniques related to Initial Access via valid accounts and Privilege Escalation within a local or networked environment. Attackers could leverage existing low-level user credentials obtained through phishing or credential stuffing attacks to initiate the exploitation process. Once inside, the ability to take over the connector implies lateral movement potential if this component interacts with other systems in the enterprise architecture. The lack of required user interaction simplifies the attack chain for automated tools once valid credentials are acquired, making it a persistent threat to organizations relying on Oracle Agile PLM for manufacturing and product development workflows.
Mitigation strategies should focus primarily on applying vendor-provided security patches or updates that address the underlying code flaw in the CAX Client component. Organizations must ensure they are running supported versions of Oracle Agile PLM MCAD Connector, as version 3.6 is explicitly identified as affected. In addition to patching, implementing strict network segmentation can limit exposure by restricting HTTP access to this specific service from untrusted networks or users who do not require it. Enforcing multi-factor authentication for all user accounts reduces the risk of credential theft leading to exploitation. Furthermore, monitoring logs for unusual activity patterns associated with low-privileged users accessing administrative endpoints can help detect attempted exploits in real-time. Regular security assessments and penetration testing should be conducted to identify similar privilege escalation flaws across other components of the supply chain management suite.