CVE-2026-71088 in Agile PLM MCAD Connector
Summary
by MITRE • 08/19/2026
Vulnerability in the Oracle Agile PLM MCAD Connector product of Oracle Supply Chain (component: CAX Client). The supported version that is affected is 3.6. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM MCAD Connector. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Agile PLM MCAD Connector accessible data. CVSS 3.1 Base Score 4.8 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/19/2026
The Oracle Agile PLM MCAD Connector, a component within the broader Oracle Supply Chain management suite, is susceptible to a vulnerability in its CAX Client module specifically affecting version 3.6. This security flaw presents as an attack vector that requires network access via HTTP and privileges limited to low-privileged users on the target system. The nature of this vulnerability is characterized by high complexity in exploitation, which serves as a significant barrier for automated or opportunistic attacks but does not eliminate the risk entirely given the specific conditions required for success.
A critical aspect of this vulnerability is the requirement for human interaction from an individual other than the attacker to facilitate the compromise. This indicates that the exploit likely relies on social engineering tactics or requires the victim user to perform a specific action, such as clicking a malicious link, opening a crafted file, or interacting with a manipulated interface element within the application. Without this interactive step, the vulnerability remains dormant and unexploitable by remote adversaries acting solely through automated scripts or passive network probes.
The operational impact of a successful exploitation is severe regarding data confidentiality but limited in scope for integrity and availability. An attacker who successfully leverages this flaw can gain unauthorized access to critical data stored within the Oracle Agile PLM MCAD Connector environment. In worst-case scenarios, the compromise extends to complete access to all accessible data managed by the connector. This level of access allows for extensive exfiltration of sensitive intellectual property, product designs, supply chain details, and other proprietary information that is central to the organization's operations and competitive advantage.
From a classification perspective, this vulnerability aligns with CWE-79 or similar categories involving input validation failures that lead to unauthorized data exposure when combined with social engineering vectors. The attack pattern corresponds to ATT&CK techniques related to phishing for credentials or initial access through user interaction, specifically leveraging the trust users place in legitimate application interfaces. The CVSS 3.1 base score of 4.8 reflects a medium severity rating driven primarily by high confidentiality impact despite low privilege requirements and high complexity constraints.
Mitigation strategies must focus on both technical controls and organizational policies due to the interactive nature of the exploit. Immediate remediation should involve applying vendor-provided patches or updates that address the flaw in the CAX Client component if available for version 3.6. In cases where patching is not immediately feasible, network segmentation can help isolate the MCAD Connector from untrusted networks, ensuring it only accepts connections from authorized internal sources. Additionally, implementing strict HTTP to HTTPS redirection and enforcing strong authentication mechanisms such as multi-factor authentication can reduce the attack surface by adding layers of verification that may disrupt the exploitation chain even if human interaction occurs.
Security awareness training is equally critical for mitigating this specific risk profile. Since successful attacks depend on user interaction, educating employees about recognizing suspicious requests or unusual behaviors within the Oracle Agile PLM interface can significantly lower the probability of compromise. Organizations should also monitor access logs for anomalous patterns that might indicate attempted exploitation attempts, allowing security teams to respond proactively before data exfiltration occurs. Regular audits of user permissions ensure that low-privileged accounts do not inadvertently hold excessive rights that could amplify the impact if a vulnerability is triggered.