CVE-2026-71089 in Agile PLM MCAD Connector
Summary
by MITRE • 08/19/2026
Vulnerability in the Oracle Agile PLM MCAD Connector product of Oracle Supply Chain (component: CAX Client). The supported version that is affected is 3.6. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Agile PLM MCAD Connector executes to compromise Oracle Agile PLM MCAD Connector. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Agile PLM MCAD Connector accessible data. CVSS 3.1 Base Score 3.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/19/2026
The Oracle Agile PLM MCAD Connector, a component of the broader Oracle Supply Chain management suite, contains a critical security flaw within its CAX Client module in version 3.6. This vulnerability stems from an improper handling of authentication and access control mechanisms that allows unauthenticated attackers to gain unauthorized entry into the system infrastructure where the connector operates. The core technical issue lies in the failure to properly validate user credentials or session states before granting access to sensitive internal resources, effectively bypassing standard security boundaries designed to protect proprietary product lifecycle data.
Exploitation of this vulnerability requires a specific set of conditions that limit its remote exploitability but increase the risk within targeted environments. An attacker must first have logon capabilities on the infrastructure hosting Oracle Agile PLM MCAD Connector, meaning they likely need physical or network-level access to the server environment rather than being able to attack from an arbitrary location over the internet. Furthermore, successful exploitation demands human interaction; specifically, a user other than the attacker must be tricked into performing an action that triggers the vulnerability. This social engineering aspect suggests the flaw may involve deceptive interface elements or malicious content embedded in files processed by the CAX Client, leading to unintended execution paths or data exposure when a legitimate user interacts with compromised assets.
The operational impact of this vulnerability is primarily focused on confidentiality rather than integrity or availability. Successful exploitation results in unauthorized read access to a subset of accessible data within Oracle Agile PLM MCAD Connector. This could expose sensitive intellectual property, design specifications, manufacturing instructions, or supply chain details that are critical to the organization's competitive advantage and operational continuity. While the system remains available and its configuration is not altered by this specific flaw, the leakage of proprietary information can have severe long-term consequences for business strategy and regulatory compliance.
From a classification perspective, this vulnerability aligns with CWE-287 Improper Authentication and CWE-200 Exposure of Sensitive Information to an Unauthorized Actor. In terms of attack tactics as defined by MITRE ATT&CK, the requirement for human interaction places it within techniques involving social engineering or user execution, while the unauthorized data access corresponds to Data Staged or Exfiltration over Alternative Protocol depending on how the attacker retrieves the stolen information. The CVSS 3.1 base score of 3.3 reflects these constraints, categorizing it as a low-severity issue due to the local attack vector and required user interaction, yet its potential for data leakage remains significant in internal network contexts.
Mitigation strategies should focus on both technical controls and procedural safeguards. Administrators must ensure that access to the infrastructure hosting Oracle Agile PLM MCAD Connector is strictly limited through robust identity and access management policies, including multi-factor authentication and least privilege principles. Network segmentation can further isolate these systems from less trusted zones to reduce the attack surface for internal threats. Additionally, organizations should apply any available patches or updates provided by Oracle that address this specific flaw in version 3.6. User awareness training is also critical to mitigate the human interaction requirement, ensuring employees recognize and avoid suspicious interactions with files or links originating from untrusted sources within their work environment.