CVE-2026-71081 in Agile PLM MCAD Connector
Summary
by MITRE • 08/19/2026
Vulnerability in the Oracle Agile PLM MCAD Connector product of Oracle Supply Chain (component: CAX Client). The supported version that is affected is 3.6. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Agile PLM MCAD Connector executes to compromise Oracle Agile PLM MCAD Connector. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Agile PLM MCAD Connector accessible data. CVSS 3.1 Base Score 1.9 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/19/2026
The vulnerability identified in the Oracle Agile PLM MCAD Connector, specifically within version 3.6 and affecting the CAX Client component, represents a low-severity integrity issue that requires significant prerequisites for exploitation. This flaw is categorized under CWE-20 Improper Input Validation or potentially CWE-798 if it involves hardcoded credentials, though the description emphasizes difficult exploitability and high privilege requirements. The vulnerability allows an attacker with local access to the infrastructure hosting the Oracle Agile PLM MCAD Connector service to compromise the integrity of accessible data. Because the attack vector is Local (AV:L) and requires High Privileges (PR:H), this indicates that the flaw cannot be exploited remotely over a network but rather necessitates physical or remote desktop access to the server where the connector resides, along with administrative-level credentials on that system.
From an operational perspective, the impact of this vulnerability is limited to integrity violations, as indicated by the CVSS 3.1 base score of 1.9 and the specific vector components showing no impact on Confidentiality or Availability. Successful exploitation enables a high-privileged attacker to perform unauthorized updates, inserts, or deletes against data accessible through the Oracle Agile PLM MCAD Connector. This could lead to the corruption of product lifecycle management records, such as bill-of-materials configurations, engineering change orders, or part specifications managed by the system. While the immediate impact is restricted to data integrity within this specific connector module, the presence of such a vulnerability suggests potential weaknesses in input sanitization routines that handle external inputs from MCAD tools integrated with Oracle Agile PLM.
The difficulty of exploitation and the requirement for high-privileged local access significantly mitigate the risk profile of this vulnerability in most enterprise environments. Attackers would need to first gain persistent, privileged control over the server infrastructure, which typically involves overcoming other security controls such as endpoint protection systems, network segmentation, and strict access management policies. Consequently, while the flaw exists within the CAX Client component, it is unlikely to be a primary entry point for widespread compromise unless the organization has already suffered a significant breach resulting in local administrative access. The vulnerability aligns with ATT&CK technique T1078 Valid Accounts if an attacker uses legitimate credentials, or potentially T1564 Hidden Files and Directories if they attempt to obscure their modifications within the data store.
Mitigation strategies for this vulnerability should focus on strict adherence to least privilege principles and robust infrastructure hardening rather than immediate patching of a low-risk flaw. Organizations running Oracle Agile PLM MCAD Connector version 3.6 should ensure that access to the server hosting the connector is strictly limited to essential administrators through multi-factor authentication and network segmentation. Regular auditing of database changes within the Agile PLM environment can help detect any unauthorized insert, update, or delete operations resulting from such an exploit. Furthermore, keeping the Oracle Agile PLM MCAD Connector updated to supported versions where potential input validation flaws are addressed is recommended as part of a comprehensive vulnerability management program that prioritizes risks based on actual exposure and business impact rather than solely on CVSS scores.