CVE-2026-83279: Oracle Agile PLM MCAD Connector Vulnerability

CVE-2026-83279 Overview

CVE-2026-83279 is an information disclosure vulnerability in the Oracle Agile PLM MCAD Connector, part of Oracle Supply Chain. The flaw resides in the CAX Client component of version 3.6. A low-privileged attacker with local logon access to the infrastructure running the connector can compromise confidentiality and read data accessible to the application.

Oracle addressed the issue in the Oracle Security Alert CSPUSEP2026. No public exploit code, proof-of-concept, or in-the-wild exploitation has been reported.

Critical Impact
A low-privileged local user can obtain unauthorized access to all data accessible to the Oracle Agile PLM MCAD Connector, including potentially sensitive product lifecycle and engineering information.

Affected Products

Oracle Agile PLM MCAD Connector, version 3.6
Component: CAX Client
Oracle Supply Chain product family

Discovery Timeline

2026-09-15 - CVE-2026-83279 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-83279

Vulnerability Analysis

The vulnerability affects the CAX Client component of the Oracle Agile PLM MCAD Connector, which bridges mechanical CAD (MCAD) applications with the Agile Product Lifecycle Management (PLM) system. The flaw allows a local, authenticated attacker holding low privileges on the host to read data that the connector can access.

Exploitation is described by Oracle as easy and does not require user interaction. The scope remains unchanged, meaning the impact is contained to the vulnerable component. Only confidentiality is affected; integrity and availability of the connector and its data remain intact.

The exposed data set can include engineering drawings, bill-of-materials entries, part metadata, and PLM credentials cached or processed by the connector. In enterprise environments, this data frequently qualifies as intellectual property.

Root Cause

Oracle has not published a detailed technical root-cause analysis. The advisory categorizes the weakness as an information disclosure issue reachable by a local, low-privileged principal on the host running the connector. Common patterns in similar client-side PLM connectors include insecure file permissions, world-readable configuration or cache files, and plaintext storage of session material.

Attack Vector

The attack requires local access with a valid low-privileged account on the system executing the CAX Client. The attacker does not need elevated rights, and no user interaction from the connector operator is required. After authenticating locally, the attacker interacts with connector resources to retrieve data that should be restricted.

See the Oracle Security Alert CSPUSEP2026 for vendor-supplied technical context. No public proof-of-concept code has been released.

Detection Methods for CVE-2026-83279

Indicators of Compromise

Unexpected access to Agile PLM MCAD Connector configuration files, cache directories, or working folders by non-administrative user accounts.
Local logons to engineering workstations or CAX Client hosts by accounts that do not typically use the connector.
Anomalous file read patterns targeting connector-owned artifacts under the user profile of the connector operator.

Detection Strategies

Enable file system auditing on directories used by the CAX Client component and alert on read access by unexpected principals.
Collect endpoint process and file telemetry from CAD workstations into a central data lake to correlate access with user identity.
Establish a baseline of normal users and processes that touch the connector, then alert on deviations.

Monitoring Recommendations

Monitor local authentication events on hosts running the Oracle Agile PLM MCAD Connector for unusual interactive or remote-desktop logons.
Track privilege changes and new local account creation on engineering endpoints.
Review Oracle Agile PLM application logs for session activity that does not align with the corresponding endpoint user.

How to Mitigate CVE-2026-83279

Immediate Actions Required

Apply the fixes referenced in Oracle Security Alert CSPUSEP2026 to all installations of Oracle Agile PLM MCAD Connector 3.6.
Inventory every workstation and server running the CAX Client component and prioritize patching for shared or multi-user hosts.
Restrict interactive logon on connector hosts to authorized engineering personnel.

Patch Information

Oracle published remediation guidance in the Oracle Security Alert CSPUSEP2026. Administrators should follow the alert to obtain the corrected version of the Oracle Agile PLM MCAD Connector and apply it to affected 3.6 deployments. Confirm the update on each host and validate that connector functionality continues to work with the associated CAD applications.

Workarounds

Enforce least privilege on hosts that run the connector and remove standing local accounts that do not require CAX Client access.
Tighten file system access control lists on connector directories so only the operating user account and administrators can read them.
Isolate connector hosts on a segmented VLAN and restrict remote logon protocols such as RDP and SSH to jump hosts.
Rotate any PLM service credentials that may have been cached by the connector on shared or exposed workstations.

bash

# Example: restrict access to the Agile PLM MCAD Connector working directory on Windows
icacls "C:\Program Files\Oracle\Agile\MCAD_Connector" /inheritance:r
icacls "C:\Program Files\Oracle\Agile\MCAD_Connector" /grant:r "Administrators:(OI)(CI)F" "SYSTEM:(OI)(CI)F" "MCAD_Users:(OI)(CI)RX"
icacls "C:\Program Files\Oracle\Agile\MCAD_Connector" /remove "Users" "Everyone"