CVE-2026-71080: Oracle Agile PLM MCAD Connector Auth Bypass

CVE-2026-71080 Overview

CVE-2026-71080 affects the Oracle Agile PLM MCAD Connector, specifically the CAX Client component in version 3.6. The flaw allows an unauthenticated attacker with adjacent network access to compromise the connector when a legitimate user performs a required action. Successful exploitation grants limited read, insert, update, or delete access to a subset of accessible data. The weakness is categorized under [CWE-284] Improper Access Control. Oracle disclosed the issue in the Oracle Security Alert of August 2026.

Critical Impact
An adjacent-network attacker can achieve partial confidentiality and integrity impact against the Oracle Agile PLM MCAD Connector when a user interacts with attacker-influenced content.

Affected Products

Oracle Supply Chain — Oracle Agile PLM MCAD Connector
Component: CAX Client
Version: 3.6

Discovery Timeline

2026-08-18 - CVE-2026-71080 published to the National Vulnerability Database
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-71080

Vulnerability Analysis

The vulnerability resides in the CAX Client component of the Oracle Agile PLM MCAD Connector 3.6. An attacker on the same physical communication segment as the host running the connector can attempt to compromise the product. Exploitation requires human interaction from a user other than the attacker, and Oracle rates the attack complexity as high. Successful exploitation yields unauthorized read, insert, update, or delete access to a subset of the connector's accessible data. Availability is not impacted.

Root Cause

Oracle's advisory maps the flaw to Improper Access Control [CWE-284]. The CAX Client does not sufficiently restrict access to resources exposed on the adjacent network segment, permitting an unauthenticated actor to influence connector behavior when a legitimate user cooperates.

Attack Vector

The attack vector is adjacent network access. An attacker must reach the physical communication segment attached to the hardware where the MCAD Connector runs. No credentials are required, but the exploit chain depends on user interaction, such as a workstation user opening or processing attacker-supplied content routed through the connector. See the Oracle Security Alert August 2026 for vendor-supplied context.

No public proof-of-concept, exploit code, or exploitation activity has been reported for CVE-2026-71080. Verified exploitation code is not available, so the vulnerability is described in prose rather than with synthetic examples.

Detection Methods for CVE-2026-71080

Indicators of Compromise

Unexpected create, update, or delete operations against Agile PLM MCAD Connector data originating from workstations on the same network segment as the connector host.
Anomalous CAX Client sessions initiated from hosts that do not normally interact with the MCAD Connector.
User reports of unexpected prompts or file operations from CAD applications integrated with the connector.

Detection Strategies

Monitor Layer 2 broadcast and adjacent-network traffic to the connector host for unusual peers and protocol patterns.
Correlate CAX Client authentication and data-modification events with the originating workstation identity and user session context.
Alert on writes to Agile PLM object types that historically only originate from a small set of engineering endpoints.

Monitoring Recommendations

Ingest Agile PLM MCAD Connector application logs, host logs, and network flow data into a centralized analytics platform for correlation.
Baseline normal CAX Client traffic volume and destinations, and alert on deviations.
Track patch state of Agile PLM MCAD Connector 3.6 systems until the vendor-supplied fix is applied.

How to Mitigate CVE-2026-71080

Immediate Actions Required

Apply the fixes referenced in the Oracle Security Alert August 2026 to all Agile PLM MCAD Connector 3.6 installations.
Inventory every workstation and server running the CAX Client and confirm patch status.
Restrict the network segment hosting the connector to authorized engineering endpoints only.

Patch Information

Oracle addressed CVE-2026-71080 in the August 2026 Security Alert cycle. Administrators should download the corresponding patch from My Oracle Support and apply it to all Oracle Agile PLM MCAD Connector 3.6 instances. Review the Oracle Security Alert August 2026 for the specific patch identifiers and installation prerequisites.

Workarounds

Segment the connector host onto a dedicated VLAN with strict Layer 2 controls and port security.
Enforce 802.1X or MAC-based network access control on switch ports that connect to CAD engineering workstations.
Train CAD users to reject unsolicited prompts or file operations from the MCAD Connector until the patch is deployed.

bash

# Configuration example: restrict the connector VLAN at the switch
interface GigabitEthernet1/0/24
 description Agile PLM MCAD Connector host
 switchport mode access
 switchport access vlan 42
 switchport port-security
 switchport port-security maximum 1
 switchport port-security violation restrict
 switchport port-security mac-address sticky
 spanning-tree portfast
 spanning-tree bpduguard enable