CVE-2026-71070 in Agile PLM MCAD Connector
Summary
by MITRE • 08/19/2026
Vulnerability in the Oracle Agile PLM MCAD Connector product of Oracle Supply Chain (component: CAX Client). The supported version that is affected is 3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM MCAD Connector. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Agile PLM MCAD Connector accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/19/2026
The Oracle Agile PLM MCAD Connector, a component of the broader Oracle Supply Chain management suite, contains a critical security flaw within its CAX Client module in version 3.6. This vulnerability stems from an insufficient access control mechanism that fails to properly enforce authorization policies for authenticated users with low privileges. The architectural design allows attackers who possess valid but limited credentials and network connectivity via HTTP to bypass intended restrictions on data retrieval operations. Because the affected component handles sensitive product lifecycle management data, including engineering specifications and manufacturing instructions stored within MCAD systems, the lack of proper validation against user roles creates a significant security gap that undermines the integrity of the access control model implemented by Oracle Agile PLM.
From an operational perspective, this flaw enables unauthorized actors to exfiltrate critical intellectual property and confidential business information without requiring elevated privileges or complex exploitation techniques. The ease of exploitation means that any network-accessible low-privileged user can potentially compromise the confidentiality of the system's data store. This directly impacts the organization's ability to maintain trade secret protection and regulatory compliance regarding sensitive engineering data. The vulnerability aligns with CWE-269, which describes Improper Privilege Management, as it involves a failure in enforcing proper access control levels for different user roles. Furthermore, this behavior is consistent with ATT&CK technique T1078, Valid Accounts, where attackers leverage legitimate credentials to gain unauthorized access to resources that should be restricted based on their privilege level.
The impact of successful exploitation is primarily focused on confidentiality, as indicated by the high severity score for data exposure in the CVSS 3.1 vector. Attackers can read sensitive files and database entries that are meant to be accessible only to higher-privileged administrators or specific functional roles within the engineering workflow. This could lead to competitive disadvantage if proprietary design documents are leaked, or it may facilitate further attacks by providing attackers with contextual information about the internal network structure and data organization. While integrity and availability impacts are not directly cited in this specific vector, the exposure of critical data often serves as a precursor for more severe compromises such as ransomware deployment or supply chain poisoning through modified design files.
To mitigate this vulnerability, organizations must immediately apply the latest security patches provided by Oracle for the Agile PLM MCAD Connector version 3.6. In environments where patching is not immediately feasible, network segmentation strategies should be employed to restrict HTTP access to the CAX Client module from untrusted or low-privilege networks. Implementing strict role-based access control reviews can help identify and revoke unnecessary permissions for users who do not require broad data access. Additionally, deploying web application firewalls with rules tailored to detect anomalous data retrieval patterns associated with this specific endpoint can provide an additional layer of defense against exploitation attempts while the underlying code issue is resolved through vendor updates.