Agile PLM MCAD Connector CVE-2026-71070

Exploitation requires a valid low-privileged account on Oracle Agile PLM MCAD Connector version 3.6, with network connectivity to the CAX Client HTTP endpoint. The CVSS PR:L metric confirms that at least one authenticated credential is necessary - unauthenticated exploitation is not indicated by the available data. Once that minimal credential is present, the Authentication Bypass tag indicates no additional privileges are needed to access all data accessible to the connector; no special configuration or non-default deployment mode is required beyond standard network exposure of the HTTP service. Limiting factors include: the attacker must obtain at least one valid user credential, exploitation is bounded to data accessible to the MCAD Connector (not necessarily the full PLM database), and the confirmed affected version is specifically 3.6. No user interaction is required (UI:N) and attack complexity is low (AC:L), making the exploit trivially automatable once credentials are available.

The CVSS 3.1 score of 6.5 reflects a network-accessible, low-complexity flaw requiring only a low-privileged account, yielding high confidentiality impact with no integrity or availability loss - a pattern typical of authorization bypass leading to data disclosure rather than code execution. Oracle's designation of the vulnerability as 'easily exploitable' is a deliberate signal in their advisory language and meaningfully lowers the estimated exploitation bar. No EPSS score was provided in the available data, and the vulnerability is absent from the CISA KEV catalog, suggesting no confirmed widespread active exploitation at time of analysis. The Authentication Bypass tag creates slight interpretive tension with the PR:L metric: the most consistent reading is that a low-privilege credential is required to initiate the HTTP session, after which authorization controls are entirely circumvented to expose data beyond the attacker's permitted scope - even a mid-sized industrial IT team in opole managing PLM infrastructure should treat this as a priority patch given the intellectual property sensitivity of engineering data typically stored in PLM systems. The absence of a CWE assignment by Oracle reduces confidence in the precise root cause, and no independent vendor advisory beyond the Oracle CPU has been identified.

An attacker in possession of any low-privileged Oracle Agile PLM account - such as a contractor, read-only reviewer, or a credential obtained through phishing - sends crafted HTTP requests to the CAX Client component of the MCAD Connector, bypassing authorization enforcement and retrieving data far beyond their permitted scope. Because the attack requires no user interaction and low complexity, an insider threat or a threat actor who has compromised a single low-value credential can immediately enumerate and exfiltrate the complete set of PLM-accessible data, potentially including sensitive MCAD design files and product specifications. No public exploit code has been identified at time of analysis.