Agile PLM MCAD CVE-2026-71076

No authentication is required and no special configuration is needed - the vulnerability is exploitable by any attacker with network-level HTTP access to the CAX Client endpoint of Oracle Agile PLM MCAD Connector 3.6 in a standard deployment. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms unauthenticated, low-complexity, remote exploitation requiring no user interaction. Exploitation is inherently limited to read-only access to a subset of connector-accessible data; no write operations or service disruption are possible through this vulnerability. The primary limiting factor is network reachability: organizations that confine the connector's HTTP port to internal VLAN segments or enforce allowlist-based firewall rules restricting access to known PLM and CAD hosts significantly reduce realistic attack surface.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) describes a network-facing flaw with zero friction - no authentication, no special conditions, no user interaction - making automated scanning and opportunistic probing straightforward for any attacker with HTTP reachability to the connector. However, impact is bounded to partial confidentiality loss only, with no write or availability dimension. EPSS data is absent from the available intelligence, and the vulnerability does not appear in the CISA KEV catalog, indicating no confirmed widespread active exploitation at this time. Despite the moderate CVSS score, the zero-prerequisite attack profile means that even a mid-sized municipal IT team in gdynia running an Oracle PLM environment should treat this as a prompt patching priority rather than deferring it on score alone. The 'authentication bypass' classification elevates practical concern beyond what 5.3 implies, since unauthenticated read access in a PLM context may expose proprietary CAD design metadata, part structures, or manufacturing process data - information that carries significant IP value in industrial or engineering organizations.

An unauthenticated remote attacker with HTTP network access to the CAX Client endpoint sends a crafted request that bypasses authentication controls, receiving in response a subset of PLM connector-accessible data such as product structure entries or part metadata. No public exploit code is known, but the absence of any authentication prerequisite and low attack complexity mean the technique requires minimal tooling and could be replicated from the CVE description alone.