CVE-2026-71089: Oracle Agile PLM MCAD Connector Vulnerability

CVE-2026-71089 Overview

CVE-2026-71089 affects the Oracle Agile PLM MCAD Connector, a product within Oracle Supply Chain. The flaw resides in the CAX Client component of version 3.6. An unauthenticated attacker with local logon access to the host running the connector can exploit the issue, but successful attack requires interaction from a second user. Exploitation yields unauthorized read access to a subset of data accessible to the connector. The weakness maps to [CWE-284] (Improper Access Control).

Critical Impact
Successful exploitation grants an attacker with local access limited unauthorized read access to Oracle Agile PLM MCAD Connector data, provided a separate user interacts with the malicious content.

Affected Products

Oracle Supply Chain
Oracle Agile PLM MCAD Connector
Oracle Agile PLM MCAD Connector version 3.6 (CAX Client component)

Discovery Timeline

2026-08-18 - CVE-2026-71089 published to the National Vulnerability Database
2026-08-20 - Last updated in the NVD database

Technical Details for CVE-2026-71089

Vulnerability Analysis

The vulnerability affects the CAX Client component of Oracle Agile PLM MCAD Connector 3.6. It is classified as an improper access control weakness [CWE-284] that discloses information. An attacker who can log on locally to the infrastructure where the connector runs may access a subset of the connector's data without authenticating to the application itself. The flaw does not permit modification of data or disruption of service, limiting impact to confidentiality of the accessible dataset.

Root Cause

Oracle's advisory attributes the issue to improper access control in the CAX Client component. The connector fails to sufficiently restrict which local users can read certain data handled by the client. Because exploitation requires interaction from a person other than the attacker, the flaw likely triggers when a legitimate user opens or processes attacker-supplied content within the connector's local environment.

Attack Vector

The attack vector is local. The attacker must possess logon access to the machine hosting Oracle Agile PLM MCAD Connector and must induce another user to perform an action, such as opening a file or interacting with a workflow, that surfaces the affected data. Oracle has not published exploit details, and no public proof-of-concept exists at the time of writing. See the Oracle Security Alert for vendor guidance.

Detection Methods for CVE-2026-71089

Indicators of Compromise

No public indicators of compromise have been published for CVE-2026-71089 at this time.
Absence of exploit reports (EPSS percentile 3.7) indicates limited real-world activity.

Detection Strategies

Inventory hosts running Oracle Agile PLM MCAD Connector 3.6 and identify local user accounts with logon rights to those systems.
Review file access and audit logs on connector hosts for unexpected reads of CAX Client data by non-privileged local users.
Correlate user-interaction events, such as file opens or CAD launches, with subsequent access to connector data directories.

Monitoring Recommendations

Enable host-based auditing of the connector installation directory and any temporary paths used by the CAX Client.
Alert on interactive logon events for accounts that do not typically administer the connector host.
Forward endpoint and file-access telemetry to a central SIEM or data lake for correlation across users and sessions.

How to Mitigate CVE-2026-71089

Immediate Actions Required

Apply the fixes referenced in the Oracle Critical Patch Update advisory for August 2026 as soon as they are available for your deployment.
Restrict local logon rights on hosts running Oracle Agile PLM MCAD Connector to trusted engineering users only.
Educate users who interact with the CAX Client on the risk of opening untrusted CAD or connector content.

Patch Information

Oracle has published remediation guidance in the Oracle Security Alert for August 2026. Administrators should apply the patch identified for Oracle Agile PLM MCAD Connector version 3.6 and validate that the CAX Client component reflects the fixed build after deployment.

Workarounds

Limit interactive access to connector hosts using operating system access controls and group policy.
Enforce least privilege on file system paths used by the CAX Client to reduce readable data for standard users.
Isolate the connector host on a segmented network zone accessible only to authorized PLM users until patches are applied.

bash

# Configuration example: restrict local logon on Windows hosts running the connector
secedit /export /cfg C:\\policy.inf
# Edit SeInteractiveLogonRight to include only authorized PLM engineering groups
secedit /configure /db C:\\policy.sdb /cfg C:\\policy.inf