Oracle Agile PLM MCAD Connector CVE-2026-71068

The CAX Client component of Oracle Agile PLM MCAD Connector 3.6 must be running and network-accessible via HTTP from the attacker's position - no authentication is required (PR:N) and no user interaction is needed (UI:N). However, attack complexity is rated High (AC:H), meaning successful exploitation is not reliably repeatable without satisfying specific preconditions, which may include race conditions, particular environmental configurations, or detailed protocol knowledge. Exploitation is limited to version 3.6; no other versions are confirmed as affected. Scope is unchanged (S:U), confining impact to the MCAD Connector itself rather than enabling lateral movement via scope escape. Internet-facing CAX Client deployments represent the highest risk profile; internally networked deployments on corporate LANs are also at risk given that no authentication barrier exists.

The CVSS 8.1 score reflects a genuinely high-severity posture: network reachable (AV:N), no authentication required (PR:N), no user interaction needed (UI:N), and total impact across confidentiality, integrity, and availability (C:H/I:H/A:H). The primary mitigating signal in the CVSS vector is high attack complexity (AC:H), which suggests exploitation is not mechanically trivial - likely requiring race conditions, precise environmental state, or non-obvious protocol manipulation rather than a simple single-packet attack. No EPSS data was provided in available intelligence, making probabilistic exploitation forecasting unavailable. The absence of a CISA KEV listing and no identified public POC reduce urgency compared to a fully weaponized vulnerability, but even a mid-sized municipal IT team in mielec should treat this as urgent if their PLM integration layer is accessible from untrusted network segments, given that a successful exploit yields complete system control. The tags include 'Information Disclosure,' which may understate the full C:H/I:H/A:H impact profile - the CVSS vector is the authoritative signal here. AC:H is the primary realistic defense until patching is completed.

An unauthenticated attacker with HTTP network access to the Oracle Agile PLM MCAD Connector's CAX Client endpoint crafts a specially formed request engineered to satisfy the high-complexity exploitation conditions - which may involve specific timing windows, environmental state manipulation, or precise knowledge of the target's protocol handling. Upon meeting those conditions, the attacker achieves full takeover of the connector system, enabling arbitrary code execution or persistent access to the PLM integration environment. No public proof-of-concept has been identified at time of analysis.