What is the CVSS score of CVE-2026-71087?

CVE-2026-71087 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Agile PLM MCAD CVE-2026-71087

EUVD-2026-62031 MEDIUM

Information Exposure (CWE-200)

2026-08-18 secalert_us@oracle.com

GHSA-cw68-cvq6-7mvp

Information Disclosure Oracle Agile Plm Mcad Connector

5.3

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Network-accessible HTTP with no authentication required (AV:N, PR:N, AC:L); impact limited to partial read of a data subset with no integrity or availability consequence.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 19, 2026 - 04:20 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Agile PLM MCAD Connector product of Oracle Supply Chain (component: CAX Client). The supported version that is affected is 3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM MCAD Connector. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Agile PLM MCAD Connector accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

AnalysisAI

Unauthorized data read in Oracle Agile PLM MCAD Connector 3.6 exposes a subset of PLM-accessible data to unauthenticated remote attackers via HTTP against the CAX Client component. Tagged explicitly as an Authentication Bypass, the flaw allows any network-reachable attacker to query protected PLM data without credentials, indicating that the CAX Client HTTP interface fails to enforce authentication on at least one data-serving endpoint. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Oracle Agile PLM MCAD Connector version 3.6 must be deployed and the CAX Client HTTP service must be network-reachable by the attacker. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 Medium score of 5.3 with AV:N/AC:L/PR:N/UI:N accurately reflects that exploitation is trivial from a technical standpoint - any attacker with HTTP reachability to the CAX Client can attempt the bypass. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Apply the patch issued by Oracle through the August 2026 Critical Security Patch Update (CPU) at https://www.oracle.com/security-alerts/cspuaug2026.html; the exact patched version number should be confirmed directly from the advisory, as a specific fix version was not independently available in the source data. … Detailed patch versions, workarounds, and compensating controls in full report.