CVE-2026-71075: Oracle Agile PLM MCAD Connector Auth Bypass

CVE-2026-71075 Overview

CVE-2026-71075 is an access control weakness in the Oracle Agile PLM MCAD Connector, part of Oracle Supply Chain. The flaw resides in the CAX Client component of version 3.6. An unauthenticated attacker with access to the adjacent network segment can compromise the connector and access sensitive engineering data. The issue maps to [CWE-284: Improper Access Control].

Successful exploitation grants read access to all data accessible by the connector and allows partial modification of that data. Exploitation requires physical proximity to the communication segment and elevated technical skill, which limits the practical attack surface.

Critical Impact
Unauthenticated adjacent-network attackers can obtain complete read access to Oracle Agile PLM MCAD Connector data and modify a subset of that data.

Affected Products

Oracle Agile PLM MCAD Connector 3.6
Component: CAX Client
Product family: Oracle Supply Chain

Discovery Timeline

2026-08-18 - CVE-2026-71075 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-71075

Vulnerability Analysis

The vulnerability affects the CAX Client component of the Oracle Agile PLM MCAD Connector, a bridge between mechanical CAD tools and Oracle's Product Lifecycle Management platform. An attacker on the same physical communication segment as the host running the connector can interact with the exposed service without authenticating. The connector fails to enforce proper access control checks on requests reaching this network-facing interface.

Once a connection is established, the attacker can read data the connector processes, including engineering drawings, part metadata, and PLM records. The attacker can also alter a limited portion of that data, which may corrupt CAD-to-PLM synchronization and downstream supply-chain records. Availability of the connector itself is not affected.

Root Cause

The root cause is improper access control [CWE-284] on the CAX Client's network-exposed interface. The component trusts requests originating from the local network segment without validating the caller's identity or authorization. High attack complexity indicates that exploitation requires specific timing, positioning, or environmental conditions on that segment.

Attack Vector

Exploitation requires adjacent-network access, meaning the attacker must reach the layer-2 broadcast domain or physical segment hosting the connector. Remote exploitation across routed networks is not viable. Typical scenarios include a compromised engineering workstation on the same VLAN, a rogue device on a manufacturing subnet, or an insider with physical plant access. No user interaction is needed once positioning is achieved.

See the Oracle Security Alert August 2026 for vendor technical details.

Detection Methods for CVE-2026-71075

Indicators of Compromise

Unexpected inbound connections to CAX Client listening ports from unusual hosts on the engineering VLAN
Unauthorized reads or modifications of CAD or PLM records outside normal engineering change workflows
New or unknown MAC addresses appearing on the network segment that hosts Agile PLM MCAD Connector systems

Detection Strategies

Baseline expected client hosts that legitimately communicate with the MCAD Connector and alert on deviations
Monitor Agile PLM audit logs for data reads or updates that do not correlate with an authenticated engineering session
Inspect network flows for CAX Client traffic sourced from workstations outside the engineering group

Monitoring Recommendations

Forward Agile PLM MCAD Connector logs and host network telemetry to a centralized analytics platform for correlation
Enable ARP and DHCP monitoring on segments hosting the connector to detect rogue devices
Track configuration changes to PLM records against approved engineering change orders to spot unauthorized edits

How to Mitigate CVE-2026-71075

Immediate Actions Required

Apply the fixes referenced in the Oracle Security Alert August 2026 to Oracle Agile PLM MCAD Connector 3.6 installations
Inventory all hosts running version 3.6 of the connector and identify which network segments expose them
Restrict access to the connector segment to authorized engineering workstations only

Patch Information

Oracle addressed this vulnerability as part of its August 2026 Critical Patch Update cycle. Administrators should review the Oracle Security Alert August 2026 for the specific patch package, apply it in a staged environment, and validate CAD-to-PLM synchronization before production rollout.

Workarounds

Isolate MCAD Connector hosts on a dedicated VLAN with strict layer-2 access control and 802.1X authentication
Enforce network segmentation between engineering workstations, the connector, and general corporate networks
Disable or firewall the CAX Client network interface where MCAD integration is not actively required

bash

# Example: restrict inbound access to the CAX Client segment using iptables
# Replace CAX_PORT and ALLOWED_SUBNET with environment-specific values
iptables -A INPUT -p tcp --dport CAX_PORT -s ALLOWED_SUBNET -j ACCEPT
iptables -A INPUT -p tcp --dport CAX_PORT -j DROP