Oracle Agile PLM MCAD Connector CVE-2026-71088

The attacker must possess a valid low-privileged account with network access to the Oracle Agile PLM MCAD Connector 3.6 CAX Client over HTTP (PR:L, AV:N). The target system must be running the specific affected version 3.6 - no other versions are confirmed affected. High attack complexity (AC:H) indicates that exploitation is not trivially repeatable and depends on race conditions, specific configuration states, or precise timing. Successful exploitation also requires human interaction from a person other than the attacker (UI:R), such as a legitimate user performing an action that the attacker can leverage or observe. Factors that limit exploitation: the attacker cannot be unauthenticated; the attack cannot be fully automated due to AC:H and UI:R; and the impact is bounded to confidentiality - no integrity or availability impact is possible through this vector. There is no indication that non-default configuration is required, but AC:H implies environmental conditions must align.

The overall real-world risk is moderate-to-low despite the C:H confidentiality impact. The CVSS base score of 4.8 (Medium) is appropriately calibrated: AC:H (high complexity) and UI:R (required human interaction) both act as significant friction points that prevent automated or wide-scale exploitation. No EPSS score was provided, so exploitation probability cannot be quantified; however, the absence of both a KEV listing and any known public exploit code further suppresses urgency. The 'Authentication Bypass' tag is the most concerning signal - if an attacker can escalate from a low-privilege session to complete data read access, the business impact in PLM environments (which store sensitive engineering IP and supply chain data) could be severe for targeted attacks. Conflicting signal worth noting: the PR:L requirement contradicts a pure authentication bypass in the traditional sense; this may indicate a post-authentication authorization bypass rather than a pre-authentication bypass - verify with Oracle's advisory. No EPSS data was included in the intelligence package, so exploitation likelihood cannot be confirmed numerically. Overall, this vulnerability is a realistic priority for organizations running Oracle Agile PLM MCAD Connector 3.6 in environments where the CAX Client is internet-facing or accessible to untrusted low-privilege users.

An attacker holding a low-privileged account in the Oracle Agile PLM environment crafts a specially constructed HTTP request targeting the CAX Client component under conditions that are difficult to reproduce (AC:H), then induces a legitimate user - such as a PLM engineer - to interact with a malicious link or session (UI:R). When the victim interaction occurs under the right conditions, the authentication bypass is triggered and the attacker gains read access to all data the CAX Client can access, potentially exposing sensitive engineering designs, supply chain records, or partner data. No public proof-of-concept code is known to exist at time of analysis.