Agile PLM MCAD Connector CVE-2026-71075

Physical or logical adjacency to the network segment where the Oracle Agile PLM MCAD Connector 3.6 hardware executes is the primary prerequisite (AV:A); remote internet-based exploitation is not possible. High attack complexity (AC:H) indicates that exploitation is not straightforward - specific conditions such as timing windows, protocol handshake states, or particular connector operational modes likely must be met. No authentication is required (PR:N per CVSS), and no user interaction is needed. Exploitation is limited by the physical network proximity requirement, which constrains threat actors to insiders, network-adjacent contractors, or attackers who have already achieved a foothold within the engineering or OT network. Availability impact is absent, so denial-of-service is not an expected outcome.

The CVSS 3.1 base score of 5.9 (Medium) accurately captures the constrained real-world risk profile. The adjacent-network attack vector (AV:A) is a meaningful limiter: exploitation requires the attacker to be physically co-located on the same network segment as the connector hardware, which substantially reduces the pool of potential threat actors to insiders, contractors with network access, or attackers who have already achieved lateral movement into the OT/engineering network. High attack complexity (AC:H) adds a further constraint, indicating that successful exploitation is not straightforward and likely depends on specific timing, protocol state, or environmental conditions. No EPSS score was provided in the available intelligence, so exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog and no public proof-of-concept code has been identified, consistent with low opportunistic exploitation risk. The confidentiality impact is High (C:H) while integrity impact is limited (I:L) and availability is unaffected (A:N), meaning the primary real-world consequence is data exposure rather than service disruption or full compromise. Overall, this is a legitimate vulnerability warranting patching on schedule, but the adjacent-vector and high-complexity constraints make it a lower operational priority than network-exposed, low-complexity flaws.

An attacker who has gained access to the engineering LAN or OT network segment - whether through insider access, a compromised workstation on the same VLAN, or physical connection to a network switch - sends crafted protocol messages to the CAX Client service on the target system. By bypassing the authentication check in the CAX Client, the attacker retrieves sensitive product lifecycle data (BOMs, CAD metadata, supply chain records) and may also inject or modify a subset of connector-accessible records, potentially corrupting design data or PLM workflows.