CVE-2026-71082 in Agile PLM MCAD Connector
Summary
by MITRE • 08/19/2026
Vulnerability in the Oracle Agile PLM MCAD Connector product of Oracle Supply Chain (component: CAX Client). The supported version that is affected is 3.6. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Agile PLM MCAD Connector executes to compromise Oracle Agile PLM MCAD Connector. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Agile PLM MCAD Connector accessible data. CVSS 3.1 Base Score 2.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/19/2026
The vulnerability identified in the Oracle Agile PLM MCAD Connector, specifically within version 3.6 and its CAX Client component, represents a low-severity but significant security flaw that impacts the confidentiality of product lifecycle management data. This software serves as an integration bridge between Oracle Agile Product Lifecycle Management systems and CAD applications such as Autodesk Inventor or AutoCAD, facilitating the exchange of engineering design data within supply chain environments. The affected component, CAX Client, is responsible for handling client-side interactions with these integrated CAD tools. While the vulnerability does not allow for remote exploitation or privilege escalation to administrative levels, it establishes a foothold that can be leveraged by an attacker who has already gained access to the underlying infrastructure where the connector executes.
The technical nature of this flaw is characterized as difficult to exploit and requires low-privileged user authentication on the host system. This classification aligns with CWE Category 269, which addresses Improper Privilege Management, specifically indicating that the application fails to enforce sufficient restrictions on a privileged account or resource before allowing actions that could impact the security of other accounts or resources. The vulnerability likely stems from insufficient validation or access control checks within the CAX Client module when processing requests or data exchanges with connected CAD applications. Because the attack vector is local and requires high complexity, it suggests that the flaw may involve a race condition, an improper handling of temporary files, or a logic error in how user sessions are managed during the synchronization process between Agile PLM and the MCAD environment. The requirement for low-privileged access means that any standard employee account with login rights to the workstation running this software can potentially trigger the vulnerability, provided they possess the necessary technical knowledge to navigate the exploitation path.
The operational impact of a successful exploit is limited to unauthorized read access to a subset of data accessible by Oracle Agile PLM MCAD Connector. This implies an information disclosure scenario where sensitive engineering designs, bill-of-materials structures, or proprietary manufacturing specifications could be exfiltrated or viewed without authorization. The CVSS 3.1 base score of 2.5 reflects this limited impact, with the vector string AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N confirming that there is no impact on integrity or availability and only a low level of confidentiality compromise. From an ATT&CK perspective, this vulnerability facilitates Initial Access via Local Account Manipulation or Valid Accounts if combined with social engineering, followed by Data Staged or Unsecured Credentials exploitation to extract the sensitive data. It does not appear to support lateral movement or persistence mechanisms directly, but it serves as a potential entry point for further reconnaissance within the internal network segment where PLM systems reside.
Mitigation strategies must focus on reducing the attack surface and enforcing strict access controls around the MCAD Connector infrastructure. Since exploitation requires local logon access, organizations should implement rigorous endpoint security policies that restrict software installation and execution privileges to authorized administrators only. Network segmentation is critical; the servers or workstations running Oracle Agile PLM MCAD Connector should be isolated in a dedicated subnet with firewall rules permitting communication only with necessary CAD server endpoints and database backends. Regular patching of the Oracle Agile PLM suite is essential, as vendors typically release updates that address such logic flaws in subsequent minor releases. Additionally, implementing strict file system permissions on directories used by the CAX Client can prevent unauthorized reading or writing of temporary data files that might be exploited during the synchronization process. Security awareness training for engineering staff who interact with these systems should also emphasize the risks associated with sharing workstation access and running unverified scripts or applications within the PLM environment.