Agile PLM MCAD CVE-2026-71072

Exploitation requires an account with at least low-level OS logon privileges on the infrastructure host where Oracle Agile PLM MCAD Connector 3.6 is installed and running - this is explicitly stated in the Oracle advisory ('attacker with logon to the infrastructure where Oracle Agile PLM MCAD Connector executes'). Network-remote exploitation is not possible; the attacker must be able to execute processes locally on the affected host. The only affected version is 3.6; no other versions are documented as vulnerable. The affected component is specifically the CAX Client. There is no user-interaction requirement beyond the attacker's own session. Exploitation is limited to partial availability impact - confidentiality and integrity are not impacted.

The CVSS 3.1 base score of 3.3 places this in the Low severity tier, and every available signal is consistent with that assessment: attack vector is Local (AV:L), meaning network-based remote exploitation is not possible; attack complexity is Low but physical or logical access to the host is a firm prerequisite; and the only impact is partial availability (A:L) with zero confidentiality or integrity consequence. No EPSS score was provided, no CISA KEV listing exists, and no public proof-of-concept has been identified at time of analysis. Even a mid-sized municipal IT team in inowroclaw managing a handful of PLM integration hosts would not need to treat this as an urgent priority over other outstanding patching work, provided host-level access controls are already enforcing the principle of least privilege. The primary real-world risk is an insider or a compromised low-privilege service account temporarily disrupting the connector process, which is inherently bounded in scope. This vulnerability presents no meaningful external attack surface.

An attacker with a low-privileged OS account on the server or workstation running Oracle Agile PLM MCAD Connector 3.6 interacts with the CAX Client component in a way that triggers a partial denial of service, disrupting connector availability until the process is restarted. This could be a malicious insider, a compromised service account, or a lateral-movement foothold with low-privilege access on the PLM infrastructure host. No public exploit identified at time of analysis, so exploitation details beyond what the CVSS vector implies are not confirmed.