Oracle Agile PLM MCAD Connector CVE-2026-71083

Exploitation requires all of the following simultaneously: (1) the attacker must have a high-privileged account with local logon capability on the infrastructure where Oracle Agile PLM MCAD Connector 3.6 executes - remote network access is insufficient; (2) the attack complexity is high, meaning specific technical conditions beyond the attacker's direct control must align; (3) a separate human user - not the attacker - must interact with the system during the attack window (UI:R). These conditions collectively make exploitation extremely difficult to stage. Exploitation is limited to a partial confidentiality disclosure of a subset of data accessible through the MCAD Connector; there is no integrity or availability impact. There is no indication of a default-configuration exposure - the attacker must already be a privileged local operator.

Risk signals uniformly point to very low real-world priority. The CVSS 3.1 base score of 1.8 is one of the lowest possible, driven by AV:L (attacker must already have a local logon to the host), AC:H (exploitation is technically difficult), PR:H (high-level privileges required on the system), UI:R (a separate user must interact during exploitation), S:U (no scope change), and C:L (only a limited subset of data exposed). No EPSS score is available in the provided data, so probabilistic exploitation likelihood cannot be quantified - this is an explicit gap. KEV status is negative and no POC has been identified. The 'Authentication Bypass' tag conflicts with the description's framing of a read-access-only confidentiality impact; if a bypass were achievable, the CVSS vector and score would likely be significantly higher. SSVC signals: exploitation status is none, automatable is no (AC:H and UI:R preclude automation), technical impact is partial. This vulnerability should be treated as a routine patch-cycle item, not an emergency.

A high-privileged attacker who already possesses a local logon to the server running Oracle Agile PLM MCAD Connector 3.6 engineers a scenario where a separate, legitimate user interacts with the CAX Client component. By exploiting the flaw under these constrained conditions, the attacker reads a limited subset of PLM-accessible data they are not authorized to view. No public exploit code has been identified, and the high complexity and dual-party requirement make opportunistic exploitation impractical.