CVE-2026-71076
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
Vulnerability in Oracle Agile PLM MCAD Connector (CAX Client component) version 3.6. An easily exploitable flaw allows an unauthenticated attacker over HTTP to gain unauthorized read access to a subset of system data.
Risk Assessment
Risk includes unauthorized access to a subset of data, potentially compromising confidentiality of processed information.
Recommendation
Update the component and restrict network access to trusted addresses only.
Other vulnerabilities in Oracle Agile PLM MCAD Connector
See all- CVE-2026-83279Medium
Vulnerability in the Oracle Agile PLM MCAD Connector product (component: CAX Client), affecting version 3.6. A low-privileged attacker with logon to the infrastructure where the component executes can gain unauthorized access to critical data or complete access to all accessible data.
- CVE-2026-83277High
Vulnerability in Oracle Agile PLM MCAD Connector (CAX Client component) affects version 3.6. A low-privileged authenticated attacker with local access can modify, delete, or access critical data. The vulnerability is easily exploitable and may impact additional products (scope change).
- CVE-2026-83274Medium
Vulnerability in the Oracle Agile PLM MCAD Connector product (component: CAX Client), affecting version 3.6. A low-privileged attacker with logon to the infrastructure where the component executes can gain unauthorized access to critical data or complete access to all accessible data.
- CVE-2026-71089Low
Vulnerability in Oracle Agile PLM MCAD Connector (CAX Client component) version 3.6. An unauthenticated attacker with logon access can gain unauthorized read access to a subset of data. Requires user interaction.
- CVE-2026-71088Medium
Vulnerability in Oracle Agile PLM MCAD Connector (component: CAX Client) version 3.6. Difficult to exploit, requires low privileges, network access (HTTP) and user interaction. Successful attack can allow full access to data.
- CVE-2026-71087Medium
Vulnerability in Oracle Agile PLM MCAD Connector (component: CAX Client) version 3.6. Easily exploitable by unauthenticated attacker over network (HTTP). Successful attack can allow unauthorized read access to a subset of data.
- CVE-2026-71083Low
Vulnerability in Oracle Agile PLM MCAD Connector (CAX Client component) version 3.6. A high-privileged attacker with logon access can gain unauthorized read access to a subset of data. Requires user interaction and is difficult to exploit.
- CVE-2026-71082Low
Vulnerability in Oracle Agile PLM MCAD Connector (CAX Client component) version 3.6. A low-privileged attacker with logon access can gain unauthorized read access to a subset of data. Difficult to exploit.
- CVE-2026-71081Low
Vulnerability in Oracle Agile PLM MCAD Connector (CAX Client component) version 3.6. A high-privileged attacker with logon access can gain unauthorized update, insert, or delete access to some data. Difficult to exploit.
- CVE-2026-71080Low
Vulnerability in Oracle Agile PLM MCAD Connector (CAX Client component) version 3.6. An unauthenticated attacker with access to the physical communication segment can gain unauthorized update, insert, delete, and read access to some data. Requires user interaction and is difficult to exploit.
Original NVD description (English source)
Vulnerability in the Oracle Agile PLM MCAD Connector product of Oracle Supply Chain (component: CAX Client). The supported version that is affected is 3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM MCAD Connector. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Agile PLM MCAD Connector accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS