Description
Vulnerability in the Oracle Agile PLM MCAD Connector product of Oracle Supply Chain (component: CAX Client). The supported version that is affected is 3.6. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM MCAD Connector. Successful attacks of this vulnerability can result in takeover of Oracle Agile PLM MCAD Connector. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-08-18
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Vulnerability in the Oracle Agile PLM MCAD Connector allows an unauthenticated attacker with network access via HTTP to compromise the component. The flaw can lead to a full takeover of the connector and consequently affects confidentiality, integrity, and availability. The CVSS v3.1 base score of 8.1 reflects the significant impact on these three core assets.

Affected Systems

The affected product is Oracle Agile PLM MCAD Connector version 3.6, part of Oracle Supply Chain. Only this version is identified as vulnerable according to the vendor's advisory.

Risk and Exploitability

The CVSS v3.1 base score is 8.1, indicating high severity. The EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog. Based on the CVSS vector, the likely attack vector is network access via HTTP, with no authentication or user interaction required. Exploitation requires only that the attacker can reach the connector over the network.

Generated by OpenCVE AI on August 24, 2026 at 23:36 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the official vendor patch to Oracle Agile PLM MCAD Connector 3.6 and any subsequent releases.
  • Configure network segmentation to limit HTTP exposure of the connector to trusted internal networks only.
  • Enable authentication and HTTPS to ensure only authorized users can access the connector.
  • Enable logging for HTTP access and monitor for suspicious activity.

Generated by OpenCVE AI on August 24, 2026 at 23:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 25 Aug 2026 00:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote Access Leads to Full Takeover of Oracle Agile PLM MCAD Connector

Mon, 24 Aug 2026 22:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Exploit for Full Takeover of Oracle Agile PLM MCAD Connector
Weaknesses CWE-284

Mon, 24 Aug 2026 19:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-306
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 20 Aug 2026 18:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Exploit for Full Takeover of Oracle Agile PLM MCAD Connector
Weaknesses CWE-284

Wed, 19 Aug 2026 22:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP-Based Remote Takeover of Oracle Agile PLM MCAD Connector
Weaknesses CWE-200
CWE-284

Wed, 19 Aug 2026 05:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP-Based Remote Takeover of Oracle Agile PLM MCAD Connector
Weaknesses CWE-200
CWE-284

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Agile PLM MCAD Connector product of Oracle Supply Chain (component: CAX Client). The supported version that is affected is 3.6. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM MCAD Connector. Successful attacks of this vulnerability can result in takeover of Oracle Agile PLM MCAD Connector. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle agile Plm Mcad Connector
CPEs cpe:2.3:a:oracle:agile_plm_mcad_connector:3.6:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle agile Plm Mcad Connector
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Agile Plm Mcad Connector
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-24T18:28:45.367Z

Reserved: 2026-08-04T22:06:34.615Z

Link: CVE-2026-71068

cve-icon Vulnrichment

Updated: 2026-08-24T18:28:35.084Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-18T21:18:06.783

Modified: 2026-08-25T16:34:47.670

Link: CVE-2026-71068

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-24T23:45:17Z

Weaknesses
  • CWE-306

    Missing Authentication for Critical Function