Agile PLM MCAD CVE-2026-71087

Oracle Agile PLM MCAD Connector version 3.6 must be deployed and the CAX Client HTTP service must be network-reachable by the attacker. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, user interaction, special timing, or non-default configuration is required - exploitation succeeds against a standard installation with default HTTP exposure. Limiting factors include: (1) the product is a specialized enterprise CAD-PLM integration tool not typically exposed to the public internet, so exploitation realistically requires internal network access or prior foothold; (2) the data exposure is scoped to 'a subset of accessible data' rather than full PLM database access; (3) integrity and availability are unaffected, limiting attacker utility to reconnaissance or data exfiltration only. The specific PLM data objects or endpoint paths accessible via the bypass are not identified in available sources.

The CVSS 3.1 Medium score of 5.3 with AV:N/AC:L/PR:N/UI:N accurately reflects that exploitation is trivial from a technical standpoint - any attacker with HTTP reachability to the CAX Client can attempt the bypass. However, the impact ceiling is low: scope is unchanged (S:U), integrity and availability are unaffected (I:N/A:N), and confidentiality exposure is partial (C:L), meaning only a subset of data is readable rather than full database access. No EPSS data was provided, making exploitation probability quantification impossible; however, the absence of KEV listing and public exploits suggests active exploitation is not currently widespread. The 'Authentication Bypass' tag is a meaningful risk amplifier - bypass vulnerabilities can sometimes serve as reconnaissance primitives enabling chaining with other weaknesses. Real-world risk is constrained by the niche deployment footprint of the MCAD Connector, which is a specialized enterprise integration tool unlikely to be internet-exposed in standard deployments.

An unauthenticated attacker with HTTP network access to the Oracle Agile PLM MCAD Connector - for example, an insider or attacker who has gained a foothold on the enterprise network - sends a crafted HTTP request directly to the CAX Client endpoint, bypassing the authentication check. The endpoint responds with a readable subset of PLM product data, such as part metadata or engineering records, without requiring any session token or credential. No public exploit code has been identified, but the straightforward nature of the bypass (low complexity, no required interaction) means a simple HTTP client or proxy tool is sufficient to reproduce the behavior.