CVE-2026-83277 in Agile PLM MCAD Connector
Summary
by MITRE • 09/16/2026
Vulnerability in the Oracle Agile PLM MCAD Connector product of Oracle Supply Chain (component: CAX Client). The supported version that is affected is 3.6. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Agile PLM MCAD Connector executes to compromise Oracle Agile PLM MCAD Connector. While the vulnerability is in Oracle Agile PLM MCAD Connector, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Agile PLM MCAD Connector accessible data as well as unauthorized read access to a subset of Oracle Agile PLM MCAD Connector accessible data. CVSS 3.1 Base Score 7.3 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified in the Oracle Agile PLM MCAD Connector, specifically within the CAX Client component of version 3.6, represents a significant security risk to organizations relying on this product for supply chain management and engineering data integration. This flaw allows an attacker with low privileges who has already established logon access to the infrastructure hosting the connector to compromise the integrity and confidentiality of the system. The presence of such a vulnerability indicates that while initial access requires authentication, the privilege level required is minimal, making it feasible for insider threats or attackers who have gained foothold through other means, such as phishing or credential theft, to escalate their impact significantly within the environment.
From a technical perspective, this flaw enables unauthorized creation, deletion, or modification of critical data accessible by the Oracle Agile PLM MCAD Connector. This aligns with CWE-798, which describes the use of hardcoded credentials or insufficient access controls that allow privilege escalation, and CWE-269, regarding improper authorization checks. The ability to modify or delete data suggests a failure in input validation or role-based access control mechanisms within the CAX Client component. Furthermore, the vulnerability also permits unauthorized read access to a subset of accessible data, pointing towards information disclosure issues consistent with CWE-200, where sensitive information is exposed to an actor that should not have access. The scope change noted in the advisory implies that compromising this connector can lead to lateral movement or impact on adjacent systems within the Oracle Supply Chain ecosystem, amplifying the blast radius of a single compromised component.
The operational impact of this vulnerability is severe due to its high integrity impact and moderate confidentiality impact, resulting in a CVSS 3.1 Base Score of 7.3. The attack vector is local with low complexity, requiring no user interaction but necessitating prior authentication. This profile suggests that the vulnerability could be leveraged by malicious insiders or external attackers who have achieved initial access through less secure means to disrupt business operations. By altering critical product lifecycle data, an attacker could introduce erroneous engineering specifications, delete essential design files, or exfiltrate proprietary intellectual property. Such actions can lead to significant financial loss, regulatory non-compliance, and damage to corporate reputation. The ATT&CK framework maps this behavior to techniques such as T1078 Valid Accounts for initial access if the low-privilege account was compromised, followed by T1565 Data Manipulation or T1005 Data Staged depending on whether data is modified or exfiltrated.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. The primary action is to apply the latest security patches provided by Oracle for version 3.6 of the Agile PLM MCAD Connector immediately upon availability. Organizations should also enforce strict network segmentation to isolate systems running this connector from general corporate networks, limiting the attack surface available to potential intruders. Implementing multi-factor authentication and enforcing the principle of least privilege across all user accounts interacting with the infrastructure can reduce the risk of low-privileged attackers gaining a foothold. Additionally, continuous monitoring for anomalous data modification or access patterns within the Agile PLM environment is recommended to detect exploitation attempts early. Regular audits of access controls and permissions assigned to service accounts associated with the CAX Client component are essential to ensure that no excessive privileges exist that could be exploited by this vulnerability.