Oracle Agile PLM MCAD Connector CVE-2026-71077

Attacker must have physical presence on or logical access to the specific network communication segment (cable segment, VLAN, or subnet) to which the host running Oracle Agile PLM MCAD Connector 3.6 is attached - this is the AV:A (Adjacent) requirement. High attack complexity (AC:H) means specific, difficult-to-reproduce conditions must be met, such as particular protocol state, timing windows, or session circumstances not fully detailed in the advisory. No authentication or privileges are required (PR:N) once adjacency and complexity conditions are satisfied. No user interaction is needed. Exploitation is limited to confidentiality impact - no write or denial-of-service capability is implied. Limiting factors: requires physical network proximity (eliminates remote internet attackers), high complexity (eliminates most automated tooling), and scope is confined to data accessible by the connector (not arbitrary system takeover).

Real-world risk is moderate-to-low despite the High confidentiality impact (C:H). The CVSS vector AV:A/AC:H constrains exploitation to attackers with physical presence on the same network segment as the MCAD Connector host, plus the ability to satisfy high-complexity prerequisites - significantly reducing the attacker pool to insiders or physically proximate adversaries. EPSS data is not provided, but given the adjacent-only vector, automated or internet-scale exploitation is not feasible. No KEV listing means CISA has not confirmed active exploitation. No public POC has been identified at time of analysis. The confidentiality-only scope (I:N, A:N) limits blast radius to data exfiltration. Risk is highest in engineering environments where sensitive IP (CAD models, BOMs, product specs) flows through the connector - a meaningful target for industrial espionage but not broad opportunistic attacks.

An attacker with physical access to the LAN segment hosting the Oracle Agile PLM MCAD Connector - such as a malicious insider, a contractor with floor access, or an attacker who has already compromised a network device on that segment - intercepts or injects traffic to the CAX Client, exploiting the authentication bypass to access all PLM data the connector can reach, including sensitive CAD models, engineering BOMs, and product specifications. No public exploit code exists, and the high complexity (AC:H) means the attacker must satisfy specific protocol or timing conditions to succeed.