Agile PLM MCAD CVE-2026-71078

Three concurrent prerequisites are required for exploitation. First, the attacker must have an active local logon session on the specific infrastructure host where Oracle Agile PLM MCAD Connector 3.6 is installed and running - the local attack vector (AV:L) makes remote network-based exploitation impossible. Second, the attacker must hold at least low-level system privileges (PR:L); anonymous or unauthenticated users cannot exploit this vulnerability. Third, a separate user - not the attacker - must take an action that triggers the vulnerable code path in the CAX Client component (UI:R), meaning the attacker cannot complete exploitation independently. High attack complexity (AC:H) further requires that race conditions, environmental timing, or specific system states align at the moment of exploitation. What limits exploitation: the local-only vector eliminates any internet-facing threat actor; the human-interaction dependency prevents automation; and the high complexity makes reliable triggering difficult to engineer on demand. The partial impact scope (C:L/I:L/A:L) also means this vulnerability cannot achieve full host compromise on its own.

The overall risk is low and unlikely to be a near-term operational priority for most organizations. The CVSS 3.1 score of 4.2 is backed by a vector that requires four simultaneous preconditions: local host access, low-privilege authentication, high attack complexity, and human interaction from a separate user - a combination that substantially narrows the realistic attacker population. No EPSS score was included in the provided intelligence data, and the vulnerability is absent from the CISA KEV catalog, confirming no known active exploitation. No proof-of-concept code has been identified. The high attack complexity (AC:H) means that even a mid-sized municipal IT team in leszno deploying this PLM connector on-premises would reasonably deprioritize this finding relative to network-exploitable or unauthenticated vulnerabilities in their environment. SSVC signals - no exploitation activity, not automatable due to human-interaction requirement, and limited technical impact - align with a 'Track' disposition rather than immediate remediation urgency. The partial impacts (C:L/I:L/A:L) confirm this cannot lead to full system compromise in a single exploitation step.

A low-privileged user with an established local session on the Agile PLM MCAD Connector 3.6 host waits for or socially engineers a second user to perform an action through the CAX Client component, then exploits the high-complexity condition - such as a timing window or specific environmental state - to intercept, modify, or partially disrupt PLM data handled by that component. No public proof-of-concept code exists, and the mandatory human-interaction requirement means fully automated or scripted exploitation is not viable with this vulnerability alone.