CVE-2026-71076 in Agile PLM MCAD Connector
Summary
by MITRE • 08/19/2026
Vulnerability in the Oracle Agile PLM MCAD Connector product of Oracle Supply Chain (component: CAX Client). The supported version that is affected is 3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM MCAD Connector. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Agile PLM MCAD Connector accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/19/2026
The Oracle Agile PLM MCAD Connector, a component within the broader Oracle Supply Chain management suite, has been identified with a significant security flaw in version 3.6 of its CAX Client module. This vulnerability stems from an insufficient access control mechanism that fails to properly enforce authentication requirements for specific HTTP-based endpoints exposed by the application. The architectural design allows unauthenticated actors who possess network connectivity to interact directly with these interfaces, bypassing standard login procedures and security gateways typically employed in enterprise environments.
From a technical perspective, this flaw represents a classic case of broken access control where the server does not validate session tokens or credentials before processing requests for sensitive data retrieval operations. The vulnerability is easily exploitable due to its low complexity requirements; an attacker needs only basic network connectivity and standard HTTP client capabilities to initiate attacks. There are no prerequisites such as user interaction, making this a remote code execution vector that can be automated at scale by threat actors scanning the internet or internal networks for vulnerable instances of Oracle Agile PLM systems.
The operational impact of this vulnerability is primarily centered on data confidentiality rather than integrity or availability. Successful exploitation allows an unauthorized attacker to read a subset of accessible data within the Oracle Agile PLM MCAD Connector environment. While the scope remains limited to reading existing information without modifying system state, the exposure of proprietary product lifecycle management data can lead to severe business consequences including intellectual property theft, competitive intelligence leakage, and potential downstream risks if this data is correlated with other compromised systems in a supply chain ecosystem.
This vulnerability aligns closely with CWE-287 Improper Authentication, as the core failure lies in the system's inability to verify the identity of users attempting to access protected resources. Furthermore, it maps to MITRE ATT&CK technique T1078 Valid Accounts or potentially T1539 Steal Web Session Cookie depending on how session management is implemented internally, though given the unauthenticated nature described, it more directly reflects a failure in authentication enforcement rather than token theft. The CVSS 3.1 base score of 5.3 indicates a medium severity level driven by network accessibility and low attack complexity but limited to confidentiality impacts with no effect on integrity or availability.
Mitigation strategies should prioritize immediate patching to the latest supported version provided by Oracle, which addresses these access control deficiencies through enhanced validation logic in the CAX Client module. In scenarios where patching is not immediately feasible, organizations must implement network-level controls such as web application firewalls configured to block unauthorized HTTP requests targeting known vulnerable endpoints. Additionally, restricting direct internet exposure of Agile PLM components and ensuring they are only accessible via secure internal networks or authenticated proxies can significantly reduce the attack surface available to external adversaries.