CVE-2026-71071 in Agile PLM MCAD Connector
Summary
by MITRE • 08/19/2026
Vulnerability in the Oracle Agile PLM MCAD Connector product of Oracle Supply Chain (component: CAX Client). The supported version that is affected is 3.6. Easily exploitable vulnerability allows low privileged attacker with access to the physical communication segment attached to the hardware where the Oracle Agile PLM MCAD Connector executes to compromise Oracle Agile PLM MCAD Connector. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Agile PLM MCAD Connector accessible data as well as unauthorized read access to a subset of Oracle Agile PLM MCAD Connector accessible data. CVSS 3.1 Base Score 4.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/19/2026
The Oracle Agile PLM MCAD Connector, a component within the Oracle Supply Chain suite specifically identified as CAX Client version 3.6, contains a critical security flaw that compromises the integrity and confidentiality of product lifecycle management data. This vulnerability arises from insufficient access controls or input validation mechanisms inherent in how the connector handles communication over its physical network segment. The architecture relies on trust assumptions regarding the local area network where it operates, failing to adequately authenticate or validate requests originating from devices connected to the same hardware environment. Consequently, any entity with logical access to this specific communication channel can interact with the service without requiring elevated privileges or user interaction, creating a significant attack surface for malicious actors operating within the internal network perimeter.
Exploitation of this flaw requires an attacker to have low-level privileged access and physical connectivity to the communication segment attached to the hardware executing the Oracle Agile PLM MCAD Connector. This typically implies that the vulnerability is exploitable by any user or process on the local subnet who can send crafted packets to the service endpoint. The absence of strong authentication mechanisms for incoming requests allows an attacker to bypass standard security boundaries, effectively treating internal network traffic as trusted when it should be subject to rigorous verification. This design flaw aligns with Common Weakness Enumeration CWE-287, which describes Improper Authentication, and CWE-915, regarding Improper Control of Dynamically-Managed Code Resources, depending on the specific implementation details of how data is processed upon receipt from the network segment.
The operational impact of a successful exploitation is substantial for organizations relying on this system for managing engineering change orders and product design data. An attacker can achieve unauthorized read access to sensitive intellectual property stored within the Oracle Agile PLM database, including proprietary designs, specifications, and supplier information. Furthermore, the vulnerability permits unauthorized updates, inserts, or deletions of accessible data, allowing an adversary to alter critical configuration settings, modify engineering records, or delete essential project files. This dual impact on both confidentiality and integrity undermines the reliability of the product lifecycle management process, potentially leading to costly rework, compliance violations, and loss of competitive advantage due to leaked intellectual property.
From a threat modeling perspective, this vulnerability facilitates lateral movement within an enterprise network if the compromised connector serves as a pivot point for further attacks against other systems on the same segment. It maps directly to MITRE ATT&CK technique T1078, Valid Accounts, where attackers use legitimate credentials or access rights obtained through lower-level compromise to maintain persistence and escalate privileges. Additionally, it relates to T1530, Data from Cloud Storage Object, if the connector interfaces with external repositories, though primarily it represents a local network-based data exfiltration and manipulation risk. The CVSS 3.1 base score of 4.6 reflects these moderate impacts on confidentiality and integrity while acknowledging that availability is not directly affected by this specific vector.
Mitigation strategies must focus on isolating the Oracle Agile PLM MCAD Connector from general user networks to enforce strict network segmentation principles. Implementing micro-segmentation ensures that only authorized management stations or application servers can communicate with the connector, thereby eliminating the attack surface for low-privileged attackers on the broader LAN. Organizations should also apply vendor-provided patches if available, as Oracle typically releases updates addressing such authentication and access control flaws in subsequent maintenance packs. Enabling comprehensive logging and monitoring of network traffic to and from the connector allows security operations centers to detect anomalous request patterns indicative of exploitation attempts. Finally, reviewing and hardening the underlying operating system permissions ensures that even if an attacker gains initial foothold on a host within the segment, they cannot easily escalate privileges to interact with the vulnerable service components effectively.