CVE-2026-71066: Oracle Agile PLM MCAD Connector Privilege Escalation

CVE-2026-71066 Overview

CVE-2026-71066 affects the Oracle Agile PLM MCAD Connector, part of the Oracle Supply Chain product family. The flaw resides in the CAX Client component of version 3.6. An unauthenticated attacker with local logon access to the host running the MCAD Connector can compromise the application, but exploitation requires user interaction from another party. Successful attacks can lead to unauthorized modification of a subset of application data, limited unauthorized read access, and partial denial of service. Oracle classifies this weakness under CWE-284: Improper Access Control.

Critical Impact
Local attackers can achieve limited data tampering, information disclosure, and partial denial of service against Oracle Agile PLM MCAD Connector 3.6 when a legitimate user interacts with attacker-supplied content.

Affected Products

Oracle Agile PLM MCAD Connector 3.6
Oracle Supply Chain — CAX Client component
Deployments where MCAD Connector runs alongside CAD workstations

Discovery Timeline

2026-08-18 - CVE-2026-71066 published to the National Vulnerability Database
2026-08-20 - Last updated in the NVD database
August 2026 - Addressed in the Oracle Security Alert August 2026

Technical Details for CVE-2026-71066

Vulnerability Analysis

The vulnerability is an improper access control weakness in the CAX Client component of Oracle Agile PLM MCAD Connector 3.6. The MCAD Connector integrates mechanical CAD (Computer-Aided Design) tools with Oracle Agile Product Lifecycle Management (PLM). The CAX Client mediates file and metadata exchange between the local workstation and the PLM server. Because access decisions are not enforced correctly, an attacker operating on the same host can influence operations that should be restricted to authorized users. The attack yields limited confidentiality, integrity, and availability impact rather than full compromise. Exploitation is rated difficult and requires user interaction, which constrains real-world attack scenarios. The EPSS probability for this CVE is 0.11%, indicating a low predicted likelihood of exploitation in the near term.

Root Cause

The defect maps to CWE-284, improper access control. The CAX Client does not consistently validate whether the caller is authorized before performing sensitive read or write operations against PLM-managed data. Additional preconditions such as timing or specific CAD workflows contribute to the high attack complexity.

Attack Vector

Exploitation requires local access to the workstation running the MCAD Connector. An unauthenticated attacker prepares malicious content or triggers a state on the local system, then relies on a legitimate CAD user to perform an action such as opening a file or executing a connector workflow. When the victim interacts with the crafted input, the connector performs privileged operations under the victim's session, allowing partial data modification, limited disclosure of PLM-accessible data, and partial denial of service. Technical specifics are limited to the information released in the Oracle Security Alert August 2026.

Detection Methods for CVE-2026-71066

Indicators of Compromise

Unexpected changes, insertions, or deletions in PLM records synchronized by the MCAD Connector
CAX Client processes launched outside of standard user CAD workflows or scheduled sync tasks
Unusual file writes into MCAD Connector working directories from non-CAD processes
Partial service outages or crashes of the MCAD Connector coinciding with user file interactions

Detection Strategies

Correlate MCAD Connector application logs with PLM server audit logs to identify modifications that lack an authorized user context
Monitor endpoint telemetry for local processes that drop content into MCAD Connector paths prior to user interaction
Baseline normal CAX Client invocation patterns and alert on deviations, particularly around off-hours activity

Monitoring Recommendations

Enable verbose auditing on the Oracle Agile PLM server for create, update, and delete operations originating from MCAD Connector sessions
Forward Windows security events and process creation logs from CAD workstations to a centralized analytics platform
Track file integrity for MCAD Connector installation and configuration directories

How to Mitigate CVE-2026-71066

Immediate Actions Required

Apply the fixes referenced in the Oracle Security Alert August 2026 to all Oracle Agile PLM MCAD Connector 3.6 installations
Inventory every workstation running the CAX Client and prioritize hosts used by engineers with elevated PLM privileges
Restrict local logon rights on workstations hosting the MCAD Connector to authorized CAD users only

Patch Information

Oracle addressed this vulnerability in the August 2026 security update cycle. Administrators should follow the guidance in the Oracle Security Alert August 2026 and update Oracle Agile PLM MCAD Connector 3.6 to the fixed release identified in that advisory.

Workarounds

Enforce least privilege on CAD workstations so unauthenticated local users cannot stage files consumed by the CAX Client
Require users to validate the origin of CAD assemblies and PLM operations before interacting with connector prompts
Segment engineering workstations from general-purpose systems to reduce opportunities for local staging of malicious content

bash

# Configuration example
# Verify installed MCAD Connector version on Windows workstations
reg query "HKLM\SOFTWARE\Oracle\Agile\MCAD Connector" /v Version

# Restrict local logon to the Engineering CAD group only (example)
secedit /export /cfg C:\secpol.cfg
# Edit SeInteractiveLogonRight to include only DOMAIN\Engineering-CAD
secedit /configure /db C:\Windows\security\local.sdb /cfg C:\secpol.cfg