CVE-2026-71071 Overview
CVE-2026-71071 affects the Oracle Agile PLM MCAD Connector product within Oracle Supply Chain, specifically the CAX Client component. The affected supported version is 3.6. A low-privileged attacker with access to the adjacent physical communication segment attached to the hardware running the connector can compromise the application. Successful exploitation permits unauthorized update, insert, or delete operations on some accessible data and unauthorized read access to a subset of accessible data.
Critical Impact
Attackers on the adjacent network can modify and read a subset of Oracle Agile PLM MCAD Connector data, undermining product lifecycle data integrity and confidentiality.
Affected Products
- Oracle Agile PLM MCAD Connector version 3.6
- Oracle Supply Chain — CAX Client component
Discovery Timeline
- 2026-08-18 - CVE-2026-71071 published to NVD
- 2026-08-20 - Last updated in NVD database
- August 2026 - Disclosed in the Oracle Security Alert August 2026
Technical Details for CVE-2026-71071
Vulnerability Analysis
The vulnerability resides in the CAX Client component of the Oracle Agile PLM MCAD Connector. The connector integrates mechanical CAD tools with Oracle Agile PLM to synchronize design and product data. An attacker on the same physical network segment as the host running the connector can interact with the client and manipulate a subset of application data. The flaw allows partial data tampering (insert, update, delete) and partial data disclosure, without impacting availability. Because the attack vector is adjacent rather than remote, exploitation requires network positioning such as a compromised endpoint on the same broadcast domain or VLAN.
Root Cause
Oracle has not published detailed root-cause information beyond the advisory. The exposure stems from insufficient access control or authentication enforcement on communications reaching the CAX Client component over the adjacent network segment, allowing a low-privileged attacker to influence connector-accessible data.
Attack Vector
Exploitation requires adjacent network access (AV:A) and low privileges (PR:L) on the target environment, with no user interaction. The attacker sends crafted traffic to the CAX Client running on the affected host, leveraging weaknesses in the client's handling of that traffic to alter or read data managed by the connector. See the Oracle Security Alert August 2026 for vendor details.
No public exploit code or proof-of-concept has been released for CVE-2026-71071. Refer to the vendor advisory for authoritative technical details.
Detection Methods for CVE-2026-71071
Indicators of Compromise
- Unexpected create, update, or delete events on Oracle Agile PLM records synchronized through the MCAD Connector.
- Anomalous inbound connections to the CAX Client host originating from unusual peers on the same VLAN or broadcast domain.
- CAX Client process activity, file access, or outbound sync operations occurring outside of normal engineering user sessions.
Detection Strategies
- Compare Agile PLM audit logs against expected CAD engineer activity to identify unauthorized data modifications flowing through the connector.
- Baseline network flows to and from hosts running Oracle Agile PLM MCAD Connector 3.6 and alert on deviations from that baseline.
- Correlate endpoint telemetry from the connector host with directory activity to spot low-privileged accounts interacting with the CAX Client unexpectedly.
Monitoring Recommendations
- Enable and forward Oracle Agile PLM application and connector logs to a centralized logging or SIEM platform for retention and correlation.
- Monitor process creation, file writes, and network sockets on hosts running the MCAD Connector for behavioral anomalies.
- Track authentication and privilege usage on accounts that access engineering workstations connected to the PLM environment.
How to Mitigate CVE-2026-71071
Immediate Actions Required
- Apply the fixes published in the Oracle Security Alert August 2026 to all Oracle Agile PLM MCAD Connector 3.6 deployments.
- Inventory all workstations and servers running the MCAD Connector and restrict their network exposure until patched.
- Review Agile PLM audit trails for unauthorized data changes preceding patch deployment.
Patch Information
Oracle addressed CVE-2026-71071 in the August 2026 Critical Patch Update. Administrators should download and apply the patches referenced in the Oracle Security Alert August 2026 advisory and validate that the CAX Client version reflects the fixed build.
Workarounds
- Segment engineering workstations running the MCAD Connector into a dedicated VLAN to remove adjacent-network access for untrusted hosts.
- Enforce least privilege on user accounts with access to the CAX Client and Agile PLM environment.
- Restrict physical and wireless access to network segments that host the connector until patches are validated.
# Example: restrict adjacent access to the CAX Client host with a host firewall
# (adjust interface, subnet, and ports to match your environment)
iptables -A INPUT -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
