Oracle Agile PLM MCAD Connector CVE-2026-71067

Requires a valid low-privileged account (PR:L per CVSS vector) on or with HTTP access to the Oracle Agile PLM MCAD Connector version 3.6. Network connectivity to the CAX Client component over HTTP is required (AV:N). No user interaction is needed on the target side (UI:N), and attack complexity is low (AC:L), meaning no race conditions, specific timing, or advanced configuration knowledge is required beyond credentials. The limiting factor is the requirement for at least a low-privileged credential - unauthenticated exploitation is not indicated by the CVSS vector. The vulnerability is specific to version 3.6; other versions are not confirmed affected. The CAX Client must be network-reachable from the attacker's position, which in many enterprise deployments may be restricted to internal networks.

The CVSS 3.1 score of 8.8 is supported by high-impact metrics across all three pillars (C:H/I:H/A:H) with low attack complexity and no user interaction - conditions that Oracle itself labels 'easily exploitable' in the advisory text. The PR:L requirement means an attacker must hold at least a low-privileged account, which is a meaningful but low barrier in enterprise environments with shared credentials or self-service account provisioning. No EPSS score was provided, limiting probabilistic exploitation forecasting. No KEV listing and no known POC reduce urgency compared to actively exploited peers, but the ease of exploitation (AC:L/UI:N) means that once a POC emerges, broad exploitation would be rapid. The tag 'Information Disclosure' in the source data understates the actual risk - the CVSS vector and Oracle's 'takeover' language confirm integrity and availability loss in addition to confidentiality. The product's niche footprint (PLM/CAD integration in manufacturing) limits the overall population at risk, but organizations with active Agile PLM deployments should treat this as high priority given the severity of the takeover outcome.

An attacker with a low-privileged account on the Oracle Agile PLM MCAD Connector sends a specially crafted HTTP request to the CAX Client interface, exploiting the vulnerability with no need for user interaction or elevated privileges. Given the AC:L rating and Oracle's 'easily exploitable' characterization, exploitation is straightforward and likely scriptable once the attack method is understood. Successful exploitation results in full takeover of the connector, potentially exposing sensitive PLM design data, intellectual property, supply chain records, and CAD artifacts managed by the system.