---
id: "CVE-2026-101723"
kind: "vulnerability"
aliases: ["CVE-2026-101723"]
title: "Oracle Agile PLM MCAD Connector CAX Client: local takeover after user interaction"
severity: "medium"
cvss: 6.7
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["mcad-connector", "oracle-agile-plm", "other", "windows"]
not_affected_if: ["product-not-installed"]
published_at: "2026-10-20T22:18:27+00:00"
first_seen_at: "2026-10-23T21:57:23+00:00"
updated_at: "2026-10-25T03:46:41+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101723", "first_seen_at": "2026-10-23T21:57:23+00:00"}]
---

# Oracle Agile PLM MCAD Connector CAX Client: local takeover after user interaction

Oracle Agile PLM MCAD Connector version 3.6 has a flaw in its CAX Client component. A low-privileged local user who can log on to the host running the connector can take it over if another person performs an action.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether Oracle Agile PLM MCAD Connector 3.6 is installed on the host; the sources do not give a file path or command.
- unknown

## Fix

- Move Oracle Agile PLM MCAD Connector to a patched release; the sources do not name the fixed version.
- unknown

## Timeline

- 2026-10-23T21:57:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101723

## From the sources

Vulnerability in the Oracle Agile PLM MCAD Connector product of Oracle Supply Chain (component: CAX Client).   The supported version that is affected is 3.6. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Agile PLM MCAD Connector executes to compromise Oracle Agile PLM MCAD Connector.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Agile PLM MCAD Connector. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_