CVE-2026-71087

Analyzed Analyzed - Analysis Complete

Unauthenticated Data Read in Oracle Agile PLM MCAD Connector

Publication date: 2026-08-18

Last updated on: 2026-08-25

Assigner: Oracle

Description

Vulnerability in the Oracle Agile PLM MCAD Connector product of Oracle Supply Chain (component: CAX Client). The supported version that is affected is 3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM MCAD Connector. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Agile PLM MCAD Connector accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-25

Generated

2026-09-08

AI Q&A

2026-08-19

EPSS Evaluated

2026-09-07

NVD

CVE-2026-71087

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	agile_plm_mcad_connector	3.6

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Agile PLM MCAD Connector version 3.6. It allows an unauthenticated attacker with network access via HTTP to read a subset of data accessible through the connector. The impact is limited to unauthorized read access without affecting integrity or availability.

Detection Guidance

This vulnerability affects Oracle Agile PLM MCAD Connector version 3.6 and allows unauthenticated network access via HTTP. To detect it, check if the system is running the vulnerable version (3.6) and if HTTP access is enabled. Inspect network traffic for unusual HTTP requests targeting the CAX Client component.

Impact Analysis

If you use Oracle Agile PLM MCAD Connector version 3.6, an attacker could access sensitive data stored in the system without needing credentials. This could lead to data leaks or unauthorized information disclosure.

Compliance Impact

This vulnerability could violate compliance requirements under GDPR or HIPAA by allowing unauthorized access to protected data. Organizations using this software may face regulatory penalties or legal consequences due to potential data breaches.

Mitigation Strategies

Apply the latest security patches from Oracle for Oracle Agile PLM MCAD Connector version 3.6. If patches are unavailable, restrict network access to the CAX Client component via HTTP and implement firewalls to limit exposure. Monitor Oracle's security advisories for updates.

Hi! I’m here to help you understand CVE-2026-71087. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70