CVE-2026-71087: Oracle Agile PLM MCAD Connector Vulnerability

CVE-2026-71087 Overview

CVE-2026-71087 is an information disclosure vulnerability in the Oracle Agile PLM MCAD Connector, part of Oracle Supply Chain. The flaw resides in the CAX Client component of version 3.6. An unauthenticated remote attacker can exploit the issue over HTTP without user interaction. Successful exploitation grants read access to a subset of data accessible through the Oracle Agile PLM MCAD Connector.

Critical Impact
Unauthenticated network attackers can read a subset of application data from the affected Oracle Agile PLM MCAD Connector deployment, exposing sensitive product lifecycle information.

Affected Products

Oracle Agile PLM MCAD Connector version 3.6
Component: CAX Client
Oracle Supply Chain product family

Discovery Timeline

2026-08-18 - CVE-2026-71087 published to the National Vulnerability Database (NVD)
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-71087

Vulnerability Analysis

The vulnerability affects the CAX Client component of Oracle Agile PLM MCAD Connector 3.6. Attackers reach the flaw through HTTP requests to the connector. Exploitation requires no authentication, no privileges, and no user interaction. The scope remains unchanged, and only confidentiality is impacted. The attacker gains partial read access to data managed by the connector, not full disclosure of application contents.

Agile PLM MCAD Connector links mechanical CAD systems to Oracle's Product Lifecycle Management (PLM) backend. Data handled by the connector typically includes design files, part metadata, engineering change records, and supply chain references. Unauthorized read access to this data can expose proprietary engineering information and intellectual property.

Root Cause

Oracle's advisory classifies the issue as an information disclosure flaw reachable over the network without authentication. The public advisory does not enumerate a specific [CWE] identifier. The confidentiality-only impact indicates that the component returns data to callers that should be restricted, consistent with missing authorization or improper access control on an HTTP-exposed interface.

Attack Vector

The attack vector is network-based over HTTP. An attacker sends crafted requests to the exposed CAX Client interface of the MCAD Connector. Because no credentials or user interaction are required, any actor with network reachability to the connector endpoint can attempt exploitation. Refer to the Oracle Security Alert for vendor-provided technical context.

No verified proof-of-concept code is publicly available for this vulnerability.
Consult the Oracle Security Alert referenced above for authoritative technical details.

Detection Methods for CVE-2026-71087

Indicators of Compromise

Unexpected HTTP requests to Oracle Agile PLM MCAD Connector endpoints from untrusted or external sources
Anomalous outbound data transfer volumes from the MCAD Connector host to unknown destinations
Access log entries showing unauthenticated requests returning application data

Detection Strategies

Enable verbose HTTP access logging on the MCAD Connector and forward logs to a centralized analytics platform for review
Baseline normal request patterns to the CAX Client interface and alert on deviations in source IP, request frequency, or response size
Correlate connector access logs with authentication events to identify requests that bypass expected login flows

Monitoring Recommendations

Monitor network flows between the MCAD Connector and both internal CAD workstations and any externally reachable interfaces
Track file access and query patterns against the PLM backend originating from the connector service account
Alert on connector access from IP ranges outside documented engineering user populations

How to Mitigate CVE-2026-71087

Immediate Actions Required

Apply the Oracle Critical Patch Update referenced in the Oracle Security Alert as soon as testing permits
Restrict network access to the MCAD Connector so only authorized engineering workstations can reach the CAX Client interface
Review recent HTTP access logs on the connector for signs of prior unauthenticated data retrieval

Patch Information

Oracle addresses this vulnerability in its August 2026 security alert cycle. Administrators should identify the specific patch bundle for Oracle Agile PLM MCAD Connector 3.6 in the Oracle Security Alert and follow Oracle's documented deployment procedure. Verify version metadata after patching to confirm remediation.

Workarounds

Place the MCAD Connector behind a reverse proxy or web application firewall that enforces source IP allowlisting for the CAX Client endpoint
Terminate HTTP and require TLS with mutual authentication for all connector traffic where the connector configuration permits
Segment the connector host into a restricted engineering VLAN with strict egress controls until the patch is applied

bash

# Example firewall restriction limiting CAX Client access to a trusted engineering subnet
iptables -A INPUT -p tcp --dport 80 -s 10.20.30.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP