Description
Vulnerability in the Oracle Project Manufacturing product of Oracle E-Business Suite (component: PJM Command Center). The supported version that is affected is V16. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Project Manufacturing executes to compromise Oracle Project Manufacturing. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Project Manufacturing accessible data as well as unauthorized access to critical data or complete access to all Oracle Project Manufacturing accessible data. CVSS 3.1 Base Score 5.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N).
Published: 2026-07-21
Score: 5.7 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability in Oracle Project Manufacturing allows an attacker with high‑privileged local access on the infrastructure that hosts the application to create, delete or modify critical data and to obtain full read access to all data managed by Oracle Project Manufacturing. This can lead to data loss, corruption and exposure of confidential information. The weakness is a CWE‑284 (Improper Access Control).

Affected Systems

Affected is Oracle Project Manufacturing, component PJM Command Center, version 16 of Oracle E‑Business Suite, distributed by Oracle Corporation.

Risk and Exploitability

The base CVSS 3.1 score is 5.7, reflecting moderate impact on confidentiality and integrity but no availability effect. The EPSS score is less than 1%, indicating a very low probability that the vulnerability is exploited in the wild. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. Exfiltration requires local access with high privileges, making the attack vector local and the attacker's ability to gain further escalation constrained to existing privileged accounts.

Generated by OpenCVE AI on August 4, 2026 at 17:27 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Oracle Project Manufacturing V16 patch released in the CPU July 2026 advisory.
  • Restrict local access and enforce least privilege for users on the infrastructure that hosts Oracle Project Manufacturing.
  • Implement regular audits of privileged accounts and application logs to detect unauthorized data access attempts.

Generated by OpenCVE AI on August 4, 2026 at 17:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 04 Aug 2026 17:45:00 +0000

Type Values Removed Values Added
Title High-Privilege Local Access Enables Unauthorized Data Modification in Oracle Project Manufacturing

Sat, 01 Aug 2026 06:30:00 +0000

Type Values Removed Values Added
Title Local High-Privilege Access Enables Unauthorized Data Modification and Full Data Access in Oracle Project Manufacturing

Sun, 26 Jul 2026 06:30:00 +0000

Type Values Removed Values Added
Title Local High-Privilege Access Enables Unauthorized Data Modification and Full Data Access in Oracle Project Manufacturing

Thu, 23 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 21 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Project Manufacturing product of Oracle E-Business Suite (component: PJM Command Center). The supported version that is affected is V16. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Project Manufacturing executes to compromise Oracle Project Manufacturing. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Project Manufacturing accessible data as well as unauthorized access to critical data or complete access to all Oracle Project Manufacturing accessible data. CVSS 3.1 Base Score 5.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N).
First Time appeared Oracle
Oracle project Manufacturing
CPEs cpe:2.3:a:oracle:project_manufacturing:v16:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle project Manufacturing
References
Metrics cvssV3_1

{'score': 5.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N'}

Subscriptions

Oracle Project Manufacturing
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-23T18:50:37.851Z

Reserved: 2026-07-08T15:51:40.530Z

Link: CVE-2026-60321

cve-icon Vulnrichment

Updated: 2026-07-23T18:49:43.843Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T17:30:03Z

Weaknesses