CVE-2026-71071

Analyzed Analyzed - Analysis Complete

Privilege Escalation in Oracle Agile PLM MCAD Connector

Publication date: 2026-08-18

Last updated on: 2026-08-25

Assigner: Oracle

Description

Vulnerability in the Oracle Agile PLM MCAD Connector product of Oracle Supply Chain (component: CAX Client). The supported version that is affected is 3.6. Easily exploitable vulnerability allows low privileged attacker with access to the physical communication segment attached to the hardware where the Oracle Agile PLM MCAD Connector executes to compromise Oracle Agile PLM MCAD Connector. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Agile PLM MCAD Connector accessible data as well as unauthorized read access to a subset of Oracle Agile PLM MCAD Connector accessible data. CVSS 3.1 Base Score 4.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-25

Generated

2026-09-08

AI Q&A

2026-08-19

EPSS Evaluated

2026-09-06

NVD

CVE-2026-71071

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	agile_plm_mcad_connector	3.6

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Agile PLM MCAD Connector version 3.6. It allows a low-privileged attacker with physical network access to exploit the system. The attack can lead to unauthorized data access or modification, affecting confidentiality and integrity.

Detection Guidance

This vulnerability requires physical access to the network segment where the Oracle Agile PLM MCAD Connector executes. Detection may involve monitoring network traffic for unauthorized data access or modification attempts. Check logs for unusual activity in the Oracle Agile PLM MCAD Connector logs or network segments connected to the hardware.

Impact Analysis

If you use Oracle Agile PLM MCAD Connector 3.6, an attacker with physical network access could read or alter some of your data without authorization. This may disrupt operations or expose sensitive information.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, which may violate GDPR or HIPAA compliance requirements for data protection and integrity.

Mitigation Strategies

Restrict physical access to the network segment and hardware where the Oracle Agile PLM MCAD Connector operates. Ensure only authorized personnel can access the system. Update to a non-vulnerable version if available. Monitor network traffic for suspicious activity.

Hi! I’m here to help you understand CVE-2026-71071. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70