CVE-2026-83277

A local privilege escalation vulnerability in the CAX Client component of Oracle Agile PLM MCAD Connector 3.6 (part of Oracle Supply Chain products) allows a low-privileged attacker with a logon to the host where the connector executes to fully compromise the connector. The flaw carries a scope change, meaning successful attacks can significantly impact additional products beyond the connector itself. A successful exploit grants unauthorized creation, deletion, or modification of critical data or all connector-accessible data, plus unauthorized read access to a subset of that data (CVSS 3.1: 7.3, AV:L/AC:L/PR:L/UI:N/S:C, with low confidentiality and high integrity impact and no availability impact). Affected organizations are primarily large manufacturers running Oracle Agile PLM with the MCAD Connector installed on CAD engineering workstations. No public proof-of-concept is known, the CVE is not on CISA's KEV list, and there is no evidence of in-the-wild exploitation.

What to do: Apply the Oracle Critical Patch Update that remediates CVE-2026-83277 to all installations of Agile PLM MCAD Connector 3.6. Because exploitation requires only a low-privileged local logon, restrict interactive and remote-desktop access to engineering workstations hosting the CAX Client and minimize local account provisioning. Review Agile PLM data for unauthorized modifications or deletions and audit connector hosts for suspicious activity by low-privileged users.