CVE-2026-71078 in Agile PLM MCAD Connector
Summary
by MITRE • 08/19/2026
Vulnerability in the Oracle Agile PLM MCAD Connector product of Oracle Supply Chain (component: CAX Client). The supported version that is affected is 3.6. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Agile PLM MCAD Connector executes to compromise Oracle Agile PLM MCAD Connector. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Agile PLM MCAD Connector accessible data as well as unauthorized read access to a subset of Oracle Agile PLM MCAD Connector accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Agile PLM MCAD Connector. CVSS 3.1 Base Score 4.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/19/2026
The vulnerability identified in the Oracle Agile PLM MCAD Connector product affects version 3.6, specifically within the CAX Client component of the Oracle Supply Chain suite. This security flaw is characterized by a complex exploitation path that necessitates specific environmental conditions and user interaction to be successfully leveraged. The attacker must possess low-privileged access rights on the infrastructure where the Oracle Agile PLM MCAD Connector executes. Furthermore, successful compromise requires human interaction from an individual other than the initial attacker, indicating that social engineering or phishing tactics may be employed to trigger the malicious sequence of events. This multi-layered requirement for exploitation significantly raises the barrier to entry for potential adversaries compared to remote code execution vulnerabilities or those requiring no user intervention.
From a technical perspective, this vulnerability falls under categories such as CWE-798: Use of Hard-coded Credentials if authentication bypass is involved, or more likely CWE-20: Improper Input Validation and CWE-434: Unrestricted Upload of File with Dangerous Type depending on the specific mechanism within the CAX Client. The presence of required human interaction aligns with ATT&CK technique T1566.001: Phishing: Spearphishing Attachment, suggesting that an attacker might deliver a malicious payload via email or other communication channels to trick a user into interacting with the vulnerable component. Once triggered by this interaction, the flaw allows for unauthorized modifications to data accessible through the connector. This includes the ability to update, insert, or delete records within the system's database or file storage mechanisms managed by Agile PLM.
The operational impact of exploiting this vulnerability is moderate but significant due to its potential effect on product lifecycle management integrity. The CVSS 3.1 base score of 4.2 reflects a Low severity rating, with vector components indicating Local attack vector (AV:L), High complexity (AC:H), Low privileges required (PR:L), and Required user interaction (UI:R). These factors combine to produce low impacts on Confidentiality, Integrity, and Availability individually. Specifically, attackers can gain unauthorized read access to a subset of accessible data, leading to potential information disclosure. Additionally, the ability to perform unauthorized updates, inserts, or deletes compromises the integrity of product design data, bills of materials, and engineering change orders stored within Agile PLM. This could lead to incorrect manufacturing instructions, flawed designs being propagated downstream, or corruption of critical project metadata.
Furthermore, the vulnerability allows for a partial denial of service against Oracle Agile PLM MCAD Connector. While not a complete system crash, this partial DOS can disrupt workflows by rendering specific modules or data sets temporarily unavailable. For organizations relying on real-time collaboration between engineering teams and manufacturing partners via the MCAD connector, such disruptions can cause delays in product development cycles and increase operational costs due to manual recovery efforts. The combination of data tampering and service disruption poses a risk to business continuity and data reliability within supply chain operations.
Mitigation strategies should focus on strict access control and user awareness training. Since exploitation requires low-privileged local logon, ensuring that only essential personnel have access to the server infrastructure hosting the connector is critical. Principle of least privilege must be enforced rigorously across all accounts interacting with the Agile PLM environment. Additionally, because human interaction is a prerequisite for successful attack, organizations should implement robust security awareness programs focusing on identifying suspicious links or attachments that might trigger this vulnerability. Network segmentation can also help isolate the MCAD connector servers from less trusted network zones to limit lateral movement opportunities if an initial foothold is gained.
Patching remains the most effective long-term solution. Administrators must ensure that Oracle Agile PLM MCAD Connector version 3.6 is updated to the latest available patch level provided by Oracle, which likely addresses the underlying code flaw in the CAX Client component. Regular vulnerability scanning and penetration testing should be conducted to identify any unpatched instances or misconfigurations that could expose this weakness. Monitoring logs for unusual activity patterns associated with file uploads or database modifications can also aid in early detection of attempted exploits. By combining technical controls with procedural safeguards, organizations can significantly reduce the risk profile associated with this vulnerability and maintain the integrity of their product lifecycle management processes.