Description
Vulnerability in the Oracle Project Manufacturing product of Oracle E-Business Suite (component: PJM Command Center). The supported version that is affected is V16. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Project Manufacturing. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Project Manufacturing accessible data. CVSS 3.1 Base Score 3.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N).
Published: 2026-07-21
Score: 3.1 Low
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Oracle Project Manufacturing, part of Oracle E‑Business Suite, has a vulnerability in the PJM Command Center component that allows a low‑privileged attacker with network access via HTTP to read a subset of data. The flaw is described as difficult to exploit and results in a confidentiality impact only, with no effect on integrity or availability.

Affected Systems

Affected systems are Oracle Corporation’s Oracle Project Manufacturing product, version 16, as part of the E‑Business Suite.

Risk and Exploitability

The CVSS Base Score is 3.1 with an EPSS score below 1%, and it is not listed in the CISA KEV catalog. Exploitation requires remote network access over HTTP, low privilege, and no user interaction. Because the attack path is straightforward but the exploitability is considered difficult, the overall risk is low, but the confidentiality impact warrants timely remediation.

Generated by OpenCVE AI on August 5, 2026 at 02:02 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply Oracle’s security patch released in the CPU Jul 2026 advisory for Oracle Project Manufacturing.
  • Configure firewall or network segmentation to limit HTTP access to the Project Manufacturing interface to authorized hosts only.
  • Continuously monitor web logs for data read attempts and investigate anomalies.

Generated by OpenCVE AI on August 5, 2026 at 02:02 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 05 Aug 2026 02:30:00 +0000

Type Values Removed Values Added
Title Information Disclosure via HTTP Read in Oracle Project Manufacturing
Weaknesses CWE-200

Tue, 04 Aug 2026 04:30:00 +0000

Type Values Removed Values Added
Title Low-Privilege HTTP Data Read in Oracle Project Manufacturing
Weaknesses CWE-200
CWE-284

Thu, 30 Jul 2026 15:15:00 +0000

Type Values Removed Values Added
Title Low-Privilege HTTP Data Read in Oracle Project Manufacturing
Weaknesses CWE-200
CWE-284

Tue, 28 Jul 2026 22:45:00 +0000

Type Values Removed Values Added
Title Unauthorized Read of Oracle Project Manufacturing via HTTP
Weaknesses CWE-200
CWE-284

Fri, 24 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
Title Unauthorized Read of Oracle Project Manufacturing via HTTP
Weaknesses CWE-200
CWE-284

Tue, 21 Jul 2026 22:00:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Project Manufacturing product of Oracle E-Business Suite (component: PJM Command Center). The supported version that is affected is V16. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Project Manufacturing. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Project Manufacturing accessible data. CVSS 3.1 Base Score 3.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N).
First Time appeared Oracle
Oracle project Manufacturing
CPEs cpe:2.3:a:oracle:project_manufacturing:v16:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle project Manufacturing
References
Metrics cvssV3_1

{'score': 3.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Oracle Project Manufacturing
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-24T17:35:52.081Z

Reserved: 2026-07-08T15:51:40.531Z

Link: CVE-2026-60339

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-05T02:15:03Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor