Oracle Agile PLM MCAD Connector CVE-2026-71081

Exploitation requires local logon access to the infrastructure host where Oracle Agile PLM MCAD Connector executes - remote network-based exploitation is not possible per AV:L. The attacker must hold a high-privilege account (PR:H), meaning a standard or low-privilege user cannot exploit this flaw. Additionally, AC:H indicates that specific technical conditions must align at the time of the attack, such as a particular system state, timing window, or non-default configuration confluence. Only version 3.6 of MCAD Connector is confirmed affected. The impact is further bounded to partial integrity modification of data accessible to the connector - no full system compromise, no data exfiltration, and no service disruption. The 'Authentication Bypass' tag in the source data is inconsistent with these prerequisites and should not be assumed to lower the effective privilege bar without vendor clarification.

Real-world risk is minimal. The CVSS 3.1 base score of 1.9 is among the lowest possible, and every metric reinforces this: AV:L (must be logged onto the host), AC:H (specific exploitation conditions must align), PR:H (requires a highly privileged account), and I:L (only partial integrity impact). There is no confidentiality or availability impact. No EPSS data was provided. The vulnerability is not in CISA KEV. No POC has been publicly disclosed. The 'Authentication Bypass' tag is a conflicting signal - if taken at face value it would suggest a higher-severity outcome, but the CVSS vector and description both constrain the impact to limited data modification by an already-privileged local user. Given the combination of local-only access, high complexity, high privilege requirement, and minimal impact scope, this vulnerability presents no credible threat to organizations that maintain standard privileged account hygiene and restrict physical or remote console access to PLM infrastructure hosts.

A system administrator or privileged service account holder with local console or remote shell access to the Oracle Agile PLM MCAD Connector 3.6 host encounters a high-complexity race condition or misconfiguration window in the CAX Client component, allowing them to inject or alter a subset of PLM-accessible data records - such as part revision metadata or CAD design attributes - without triggering expected authorization controls. No public exploit code exists to facilitate this scenario at time of analysis.