CVE-2026-71077: Oracle Agile PLM MCAD Connector Data Leak

CVE-2026-71077 Overview

CVE-2026-71077 affects the Oracle Agile PLM MCAD Connector, a component of Oracle Supply Chain. The flaw resides in the CAX Client and impacts version 3.6. An unauthenticated attacker with access to the physical communication segment attached to the host can compromise the connector. Successful exploitation grants unauthorized access to all data accessible by the Oracle Agile PLM MCAD Connector. The weakness is categorized under CWE-284: Improper Access Control.

Critical Impact
Successful exploitation exposes all data accessible by the Oracle Agile PLM MCAD Connector to an adjacent-network attacker without requiring authentication or user interaction.

Affected Products

Oracle Agile PLM MCAD Connector version 3.6
Oracle Supply Chain (CAX Client component)
Deployments exposing the connector on shared local network segments

Discovery Timeline

2026-08-18 - CVE-2026-71077 published to the National Vulnerability Database
2026-08-18 - Oracle publishes advisory in the Oracle Security Alert CSPU Aug 2026
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-71077

Vulnerability Analysis

The vulnerability is a broken access control issue [CWE-284] in the CAX Client component of the Oracle Agile PLM MCAD Connector. The connector fails to enforce sufficient authorization checks on requests received through its local network interfaces. An attacker who can reach the connector across the adjacent network segment can query or retrieve sensitive engineering, product lifecycle, and design data without presenting credentials.

The impact is confined to confidentiality. Integrity and availability of the connector are not affected. Exploitation complexity is high because the attacker must reach the physical communication segment attached to the host and satisfy timing or configuration conditions specific to the CAX Client protocol.

No public proof-of-concept is available, and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The root cause is improper access control on the CAX Client interface used by the Oracle Agile PLM MCAD Connector to communicate with mechanical CAD integrations. The service exposes data-access functionality on a network endpoint without validating that the requesting peer holds the required authorization. This allows unauthenticated readers on the same broadcast domain to retrieve records the connector is permitted to see.

Attack Vector

The attack vector is adjacent network, meaning the attacker must be on the same physical or logical Layer 2 segment as the host running the Oracle Agile PLM MCAD Connector. No credentials and no user interaction are required. Typical exploitation paths include a compromised workstation on the engineering LAN, a rogue device plugged into an office switch, or a foothold gained through a lateral-movement stage that reaches the CAD user subnet.

Oracle has not published exploit details. Refer to the Oracle Security Alert CSPU Aug 2026 for authoritative technical context.

Detection Methods for CVE-2026-71077

Indicators of Compromise

Unexpected inbound sessions to the Oracle Agile PLM MCAD Connector host from workstations not enrolled in engineering CAD workflows.
Bulk read operations against the CAX Client interface outside standard engineering hours.
Presence of unmanaged or newly introduced devices on the VLAN hosting the connector.

Detection Strategies

Baseline the set of client IP addresses that legitimately talk to the connector, then alert on any deviation.
Inspect network flow logs for sustained connections to CAX Client ports originating from non-CAD endpoints.
Correlate connector access telemetry with authentication events to surface sessions that produced no corresponding user login.

Monitoring Recommendations

Enable verbose logging on the Oracle Agile PLM MCAD Connector and forward records to a centralized analytics platform for retention and query.
Monitor VLANs that carry engineering traffic for ARP anomalies, new MAC addresses, and rogue DHCP responses.
Track egress volumes from the connector host to detect large data pulls consistent with confidentiality compromise.

How to Mitigate CVE-2026-71077

Immediate Actions Required

Apply the fix supplied in the Oracle Security Alert CSPU Aug 2026 as soon as change windows allow.
Inventory all hosts running Oracle Agile PLM MCAD Connector 3.6 and confirm their network exposure.
Restrict Layer 2 access to the connector subnet to authorized CAD workstations only.

Patch Information

Oracle addressed CVE-2026-71077 in the August 2026 Critical Security Patch Update. Administrators should download and apply the patch referenced in the Oracle Security Alert CSPU Aug 2026. Confirm the update on every instance of Oracle Agile PLM MCAD Connector 3.6 before returning the systems to production.

Workarounds

Segment the Oracle Agile PLM MCAD Connector onto an isolated VLAN with strict access control lists limiting Layer 2 reachability.
Enforce 802.1X port-based authentication on switches serving the engineering network to block unauthorized devices.
Disable or firewall the CAX Client listener on hosts that do not require CAD integration until patching completes.

bash

# Example: restrict adjacent-network access to the connector host with iptables
# Replace 10.20.30.0/24 with the authorized CAD workstation subnet
# Replace <PORT> with the CAX Client listening port in your environment
iptables -A INPUT -p tcp --dport <PORT> -s 10.20.30.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport <PORT> -j DROP