CVE-2026-71068

Analyzed Analyzed - Analysis Complete

Takeover vulnerability in Oracle Agile PLM MCAD Connector

Publication date: 2026-08-18

Last updated on: 2026-08-25

Assigner: Oracle

Description

Vulnerability in the Oracle Agile PLM MCAD Connector product of Oracle Supply Chain (component: CAX Client). The supported version that is affected is 3.6. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM MCAD Connector. Successful attacks of this vulnerability can result in takeover of Oracle Agile PLM MCAD Connector. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-25

Generated

2026-09-08

AI Q&A

2026-08-19

EPSS Evaluated

2026-09-07

NVD

CVE-2026-71068

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	agile_plm_mcad_connector	3.6

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Agile PLM MCAD Connector version 3.6. It allows an unauthenticated attacker to remotely access the system via HTTP and potentially take full control of it. The attack is difficult to execute but could lead to complete compromise of the affected software.

Detection Guidance

Detecting this vulnerability requires checking for the presence of Oracle Agile PLM MCAD Connector version 3.6. Inspect installed software versions on systems where this component may be deployed. Monitor network traffic for HTTP requests targeting the CAX Client component. Ensure all Oracle products are updated to the latest patched versions.

Impact Analysis

If exploited, this vulnerability could allow an attacker to take over the Oracle Agile PLM MCAD Connector, leading to unauthorized access, data theft, or system manipulation. This could disrupt operations and expose sensitive information.

Compliance Impact

This vulnerability allows unauthenticated attackers to compromise the Oracle Agile PLM MCAD Connector, potentially leading to unauthorized access, data breaches, or system takeover. Such breaches could expose sensitive data, violating GDPR (data protection) and HIPAA (health information privacy) requirements, depending on the data processed by the system.

Mitigation Strategies

Apply the latest security patches or updates provided by Oracle for the Agile PLM MCAD Connector version 3.6. Ensure network access to the component is restricted via HTTP and consider disabling unnecessary services. Monitor for unusual activity or unauthorized access attempts.

Hi! I’m here to help you understand CVE-2026-71068. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70