CVE-2026-71075 in Agile PLM MCAD Connector
Summary
by MITRE • 08/19/2026
Vulnerability in the Oracle Agile PLM MCAD Connector product of Oracle Supply Chain (component: CAX Client). The supported version that is affected is 3.6. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle Agile PLM MCAD Connector executes to compromise Oracle Agile PLM MCAD Connector. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Agile PLM MCAD Connector accessible data as well as unauthorized update, insert or delete access to some of Oracle Agile PLM MCAD Connector accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/19/2026
The Oracle Agile PLM MCAD Connector, a component within the broader Oracle Supply Chain management suite, is susceptible to an unauthenticated vulnerability that affects version 3.6 of the CAX Client module. This security flaw resides in the communication handling mechanisms of the connector, which serves as an interface between the Oracle Agile Product Lifecycle Management system and CAD data repositories. The nature of this vulnerability allows for unauthorized access by attackers who have established a position on the physical network segment where the vulnerable hardware operates. Because the exploit requires proximity to the local area network or direct physical connectivity to the communication infrastructure, it is classified as difficult to exploit from remote locations over wide-area networks. This constraint significantly limits the attack surface but does not eliminate the risk for organizations with insufficiently segmented internal networks or compromised endpoint devices on the same broadcast domain.
From a technical perspective, the vulnerability stems from inadequate authentication checks within the CAX Client component when processing incoming requests. An attacker positioned on the local network segment can interact directly with the service without providing valid credentials. This lack of proper access control verification enables the adversary to bypass standard security gateways that might otherwise filter traffic based on identity tokens or session states. The flaw essentially treats any request originating from the trusted physical layer as legitimate, ignoring the need for cryptographic proof of identity or authorization headers typically required by enterprise-grade PLM systems. This design oversight creates a pathway for malicious actors to inject commands or query sensitive data structures without triggering standard intrusion detection alerts associated with brute-force attacks or credential stuffing attempts.
The operational impact of this vulnerability is substantial regarding both confidentiality and integrity, as reflected in the CVSS 3.1 base score of 5.9. Successful exploitation allows an unauthenticated attacker to gain unauthorized access to critical intellectual property stored within the Oracle Agile PLM environment. This includes sensitive design files, engineering specifications, bill-of-materials data, and other proprietary information that constitutes a company's competitive advantage. Furthermore, the vulnerability permits unauthorized modifications to this data, including updates, inserts, or deletions. Such integrity violations can lead to corrupted product designs, incorrect manufacturing instructions, or the introduction of malicious code into downstream production systems if the PLM system is integrated with ERP or MES platforms. The absence of availability impact in the CVSS vector indicates that while data theft and tampering are possible, the vulnerability does not directly cause denial-of-service conditions against the connector service itself.
In terms of industry standard classifications, this vulnerability aligns closely with CWE-287 Improper Authentication, as it involves a failure to verify user identity before granting access to protected resources. Additionally, because the attack requires local network proximity and unauthenticated interaction, it maps to MITRE ATT&CK technique T1046 Network Service Discovery or potentially T1539 Steal Web Session Cookie if session hijacking is involved in conjunction with other vectors, though primarily it represents a direct authentication bypass on a specific service endpoint. The attack vector AV:A indicates an Adjacent network position, which necessitates that the attacker be physically connected to the same LAN segment as the target system. This context highlights the importance of micro-segmentation and zero-trust architecture principles in industrial IT environments where legacy systems like Oracle Agile PLM may still rely on older communication protocols with weaker security postures.
Mitigation strategies should focus on network isolation and access control hardening. Organizations running version 3.6 must immediately restrict network access to the CAX Client service using firewall rules that limit connectivity only to authorized application servers or specific management workstations, rather than allowing open access from the entire local subnet. Implementing VLAN segmentation is critical to ensure that general user traffic cannot reach the PLM connector hardware directly. Additionally, deploying intrusion prevention systems with signatures capable of detecting anomalous communication patterns associated with this vulnerability can provide an additional layer of defense. Oracle has likely released patches or configuration updates in subsequent versions; therefore, upgrading to a supported version where authentication mechanisms are strengthened is the most effective long-term remediation. Until such upgrades occur, strict network monitoring and logging should be enabled to detect any unauthorized connection attempts from adjacent hosts on the physical communication segment.