CVE-2026-71078

Received Received - Intake

Privilege Escalation in Oracle Agile PLM MCAD Connector

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: Oracle

Description

Vulnerability in the Oracle Agile PLM MCAD Connector product of Oracle Supply Chain (component: CAX Client). The supported version that is affected is 3.6. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Agile PLM MCAD Connector executes to compromise Oracle Agile PLM MCAD Connector. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Agile PLM MCAD Connector accessible data as well as unauthorized read access to a subset of Oracle Agile PLM MCAD Connector accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Agile PLM MCAD Connector. CVSS 3.1 Base Score 4.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-18

Generated

2026-08-19

AI Q&A

2026-08-19

EPSS Evaluated

N/A

NVD

CVE-2026-71078

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	agile_plm_mcad_connector	3.6

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability affects Oracle Agile PLM MCAD Connector version 3.6. It allows a low-privileged attacker with local access to compromise the system through human interaction by another person. The attacker can gain unauthorized read, update, insert, or delete access to some data and cause partial denial of service.

The vulnerability has a CVSS base score of 4.2, indicating limited impact on confidentiality, integrity, and availability.

Impact Analysis

If you use Oracle Agile PLM MCAD Connector version 3.6, an attacker with local access could exploit this to read, modify, or delete some data in the system. They could also disrupt service partially, though full system compromise is unlikely.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, which may violate GDPR (data protection) or HIPAA (health data privacy) if sensitive information is exposed or altered. Organizations using this software should assess potential compliance risks.

Mitigation Strategies

Apply the latest security patches from Oracle for Oracle Agile PLM MCAD Connector version 3.6. Restrict user privileges to the minimum required. Monitor network traffic for unusual activity involving the CAX Client component. Ensure all users are trained to avoid suspicious interactions that could trigger the vulnerability.

Hi! I’m here to help you understand CVE-2026-71078. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70