CVE-2026-83277: Oracle Agile PLM Privilege Escalation Flaw

CVE-2026-83277 Overview

CVE-2026-83277 affects the Oracle Agile PLM MCAD Connector, a component of the Oracle Supply Chain product family. The flaw resides in the CAX Client component of version 3.6. A low-privileged attacker with logon access to the infrastructure where the connector runs can compromise the application without user interaction. The vulnerability carries a scope change, meaning successful exploitation can impact components beyond the vulnerable product itself. Attackers gain unauthorized create, delete, or modify access to critical data, along with read access to a subset of accessible data.

Critical Impact
Local, low-privileged attackers can modify or delete critical Oracle Agile PLM MCAD Connector data and read a subset of connector-accessible data, with impact extending beyond the vulnerable component due to scope change.

Affected Products

Oracle Agile PLM MCAD Connector 3.6
Component: CAX Client
Oracle Supply Chain product family

Discovery Timeline

2026-09-15 - CVE-2026-83277 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-83277

Vulnerability Analysis

The vulnerability exists in the CAX Client component of the Oracle Agile PLM MCAD Connector. Oracle classifies exploitation as easy, requiring only local logon access and low privileges on the host executing the connector. No user interaction is required to trigger the flaw.

Successful exploitation results in high integrity impact and low confidentiality impact. Attackers can create, delete, or modify all data accessible to the connector and read a subset of that data. Oracle has not released technical details about the underlying weakness in the public advisory.

The scope change indicator means the security impact crosses a trust boundary. Damage can extend to components managed by security authorities different from the vulnerable connector itself, expanding the blast radius across integrated Oracle Supply Chain systems.

Root Cause

Oracle has not published the specific weakness class or CWE identifier for this vulnerability. The Oracle Security Alert CSPUSEP2026 references the flaw but does not disclose implementation details. Based on the CVSS metrics and the local attack vector combined with scope change, the root cause is consistent with improper access control or insufficient authorization enforcement within the CAX Client component.

Attack Vector

Exploitation requires local access to the infrastructure hosting the Oracle Agile PLM MCAD Connector. The attacker must hold a valid low-privileged account on that host. Once authenticated locally, the attacker interacts with the CAX Client component to trigger the flaw.

Because the vulnerability does not require user interaction and has low attack complexity, an authenticated insider or an attacker who has already established a foothold on an adjacent workstation can weaponize the flaw reliably. Detailed exploitation mechanics are not publicly disclosed. See the Oracle Security Alert CSPUSEP2026 for vendor guidance.

Detection Methods for CVE-2026-83277

Indicators of Compromise

Unexpected create, modify, or delete operations against Oracle Agile PLM MCAD Connector data stores
Anomalous CAX Client process activity originating from low-privileged local accounts
Cross-system data changes in integrated Oracle Supply Chain components that trace back to the connector host

Detection Strategies

Audit local logon events on hosts running Oracle Agile PLM MCAD Connector 3.6 and correlate against expected user activity
Monitor file and database write operations performed by the CAX Client process for deviations from baseline behavior
Alert on privilege boundary crossings where connector-initiated actions affect data owned by other Oracle Supply Chain components

Monitoring Recommendations

Enable verbose logging on the Agile PLM MCAD Connector and forward events to a centralized SIEM for correlation
Track integrity of PLM metadata and CAD artifacts using file integrity monitoring on the connector host
Review access logs from downstream Oracle Supply Chain systems for unauthorized modifications initiated via the connector

How to Mitigate CVE-2026-83277

Immediate Actions Required

Apply the patches referenced in Oracle Security Alert CSPUSEP2026 to all Oracle Agile PLM MCAD Connector 3.6 installations
Inventory hosts running the connector and restrict local logon rights to only required administrative personnel
Rotate credentials for accounts with local access to connector infrastructure following patch deployment

Patch Information

Oracle addressed CVE-2026-83277 as part of the Oracle Security Alert CSPUSEP2026 published September 15, 2026. Administrators should review the alert for the specific patch bundle applicable to Oracle Agile PLM MCAD Connector 3.6 and apply it during the next maintenance window. Refer to the Oracle Security Alert CSPUSEP2026 for full remediation details.

Workarounds

Restrict interactive and remote logon on connector hosts to a minimal set of trusted administrators
Enforce host-based access controls to prevent unauthorized local accounts from invoking the CAX Client
Segment the connector infrastructure from general-purpose user workstations to reduce lateral movement risk

bash

# Example: restrict interactive logon on the connector host (Windows)
# Review current logon rights
secedit /export /cfg C:\policy\current.inf

# After editing 'SeInteractiveLogonRight' to include only approved admin groups:
secedit /configure /db secedit.sdb /cfg C:\policy\hardened.inf /overwrite