Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.6

Oracle Agile PLM MCAD Connector 3.6 Allows Unauthorized Data Access

CVE-2026-71071 · published 2 months ago
Summary

A vulnerability in the Oracle Agile PLM MCAD Connector version 3.6 allows a low-privileged attacker to access and modify sensitive data. This means that an attacker with limited access can potentially view or change important information. Oracle recommends updating to a fixed version of the software to mitigate this risk.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
oracle corporation oracle agile plm mcad connector 3.6
oracle agile_plm_mcad_connector 3.6
cpe:2.3:a:oracle:agile_plm_mcad_connector:3.6:*:*:*:*:*:*:*
Original advisory text
Vulnerability in the Oracle Agile PLM MCAD Connector product of Oracle Supply Chain (component: CAX Client). The supported version that is affected is 3.6. Easily exploitable vulnerability allows...
Vulnerability in the Oracle Agile PLM MCAD Connector product of Oracle Supply Chain (component: CAX Client). The supported version that is affected is 3.6. Easily exploitable vulnerability allows low privileged attacker with access to the physical communication segment attached to the hardware where the Oracle Agile PLM MCAD Connector executes to compromise Oracle Agile PLM MCAD Connector. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Agile PLM MCAD Connector accessible data as well as unauthorized read access to a subset of Oracle Agile PLM MCAD Connector accessible data. CVSS 3.1 Base Score 4.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
4.6 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-284Improper Access Control
Timeline
Published18 Aug 2026
Updated4 Nov 2026
First seen18 Aug 2026
Sources
CVE-2026-71071 · NVD
CVE-2026-71071 · MITRE
Track software like this
Free during beta