CVE-2026-71076: Oracle Agile PLM MCAD Connector Vulnerability

CVE-2026-71076 Overview

CVE-2026-71076 is an information disclosure vulnerability in the Oracle Agile PLM MCAD Connector, specifically within the CAX Client component. The affected version is 3.6. An unauthenticated attacker with network access via HTTP can exploit the flaw to read a subset of data accessible to the MCAD Connector. The vulnerability is classified under [CWE-284] Improper Access Control. Oracle disclosed the issue in the Oracle Security Alert Advisory for August 2026.

Critical Impact
Unauthenticated network attackers can obtain unauthorized read access to a subset of Oracle Agile PLM MCAD Connector data without user interaction.

Affected Products

Oracle Agile PLM MCAD Connector 3.6
Component: CAX Client
Oracle Supply Chain product family

Discovery Timeline

2026-08-18 - CVE-2026-71076 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-71076

Vulnerability Analysis

The vulnerability resides in the CAX Client component of Oracle Agile PLM MCAD Connector 3.6. It permits an unauthenticated remote attacker to reach protected resources over HTTP without proper access control checks. Successful exploitation yields unauthorized read access to a subset of data handled by the connector. The flaw affects confidentiality only; integrity and availability of the target system remain intact. Oracle categorizes the issue as easily exploitable, meaning no specialized conditions or elevated context are required. The MCAD Connector integrates mechanical CAD applications with Agile Product Lifecycle Management, so exposed data may include product design metadata routed through the connector.

Root Cause

The root cause is improper access control [CWE-284] in the CAX Client component. Requests reaching the connector over HTTP are not subject to adequate authorization enforcement, allowing an anonymous caller to retrieve data intended for authenticated principals. Oracle has not published low-level implementation details in the public advisory.

Attack Vector

The attack vector is network-based over HTTP. The attacker requires no privileges and no user interaction. The scope remains unchanged, and the impact is limited to confidentiality of a subset of connector-accessible data. See the Oracle Security Alert August 2026 for advisory details.

Detection Methods for CVE-2026-71076

Indicators of Compromise

Unauthenticated HTTP requests to Oracle Agile PLM MCAD Connector endpoints originating from external or unexpected internal sources.
HTTP responses returning connector data payloads to sessions that never presented valid authentication tokens.
Anomalous access patterns targeting the CAX Client component outside normal CAD engineering workflows.

Detection Strategies

Inspect web server and reverse proxy logs for HTTP requests to MCAD Connector URIs without authenticated session cookies or tokens.
Correlate connector access events with authentication logs to surface requests that bypass identity checks.
Deploy network signatures on perimeter and internal segmentation devices to alert on direct HTTP access to the connector from non-engineering subnets.

Monitoring Recommendations

Forward MCAD Connector, application server, and network telemetry to a centralized analytics platform for longitudinal review.
Baseline normal connector request volume and alert on statistically significant spikes or off-hours access.
Monitor egress from the connector host for unusual data transfer volumes that could indicate bulk data retrieval.

How to Mitigate CVE-2026-71076

Immediate Actions Required

Apply the fixes distributed in the Oracle Security Alert August 2026 to affected Oracle Agile PLM MCAD Connector 3.6 deployments.
Restrict network reachability of the MCAD Connector so only authorized engineering endpoints and integration hosts can connect.
Audit recent HTTP access logs for anonymous requests that returned connector data.

Patch Information

Oracle addressed CVE-2026-71076 in the Oracle Security Alert Advisory published in August 2026. Administrators should follow the vendor advisory to identify the specific patch bundle applicable to their Agile PLM MCAD Connector 3.6 installation and apply it during a controlled maintenance window. Consult the Oracle Security Alert August 2026 for prerequisite patches and installation sequencing.

Workarounds

Place the MCAD Connector behind an authenticating reverse proxy or web application firewall that enforces identity before requests reach the CAX Client component.
Enforce network access control lists limiting HTTP traffic to the connector to known engineering workstations and integration servers.
Disable or firewall off the connector service in environments where MCAD integration is not actively required until patching is complete.

bash

# Example: restrict inbound HTTP to the connector using host-based firewall rules
# Replace 10.0.0.0/24 with the trusted engineering subnet and <connector_port> with the deployed port
iptables -A INPUT -p tcp --dport <connector_port> -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport <connector_port> -j DROP