CVE-2026-60337 in Project Manufacturing
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Project Manufacturing product of Oracle E-Business Suite (component: PJM Command Center). The supported version that is affected is V16. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Project Manufacturing executes to compromise Oracle Project Manufacturing. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Project Manufacturing accessible data as well as unauthorized update, insert or delete access to some of Oracle Project Manufacturing accessible data. CVSS 3.1 Base Score 4.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle Project Manufacturing, a component of the Oracle E-Business Suite that operates under version V16. The flaw exists specifically within the PJM Command Center module, representing a significant security weakness that requires elevated privileges to exploit effectively. The vulnerability's classification as difficult to exploit indicates that while it presents a real threat, it does not offer the same accessibility as more straightforward attack vectors. Security researchers have identified this issue through comprehensive analysis of the software architecture and its interaction with underlying system resources.
The technical nature of this vulnerability stems from insufficient access controls or authentication mechanisms within the PJM Command Center functionality. Attackers who successfully gain logon credentials to the system where Oracle Project Manufacturing operates can leverage this weakness to compromise the entire module. The attack requires high privileged access, suggesting that standard user accounts would not suffice for exploitation. This characteristic places the vulnerability in a category where it primarily affects internal threat actors or attackers who have already achieved some level of system access through other means.
The operational impact of this vulnerability extends beyond simple data theft to encompass complete compromise of sensitive project manufacturing information. Successful exploitation allows unauthorized access to critical data repositories that contain confidential project specifications, resource allocations, and financial information. Additionally, the vulnerability enables unauthorized modification capabilities, permitting attackers to insert, update, or delete data within the system. This dual nature of impact affects both confidentiality and integrity aspects of the information security triad, with the confidentiality impact rated as high due to potential exposure of sensitive business data.
From a risk assessment perspective, the CVSS 3.1 base score of 4.7 indicates a medium severity vulnerability that requires careful consideration by system administrators and security teams. The vector analysis reveals an attack vector of local access with high complexity requirements and high privileges needed for exploitation. The lack of user interaction requirements suggests this could be automated or require minimal human involvement once initial access is achieved. The scope impact is rated as unchanged, meaning the compromise remains contained within the Oracle Project Manufacturing component rather than affecting other system components.
Organizations should implement comprehensive mitigation strategies that include regular security updates and patches from Oracle to address this vulnerability. Network segmentation and least privilege access controls can help reduce the potential impact of successful exploitation attempts. Monitoring for unusual access patterns or unauthorized modifications within the PJM Command Center functionality should be implemented as part of ongoing security operations. The vulnerability aligns with CWE categories related to insufficient access control and privilege escalation, representing a common weakness in enterprise resource planning systems where complex access controls must be maintained across multiple modules.
Security teams should consider implementing additional protective measures such as database activity monitoring, privileged account management protocols, and regular penetration testing focused on the affected components. The ATT&CK framework would categorize this vulnerability under privilege escalation techniques, particularly targeting the system service or application level access control mechanisms. Organizations maintaining Oracle E-Business Suite environments must prioritize patch management procedures to ensure timely deployment of security fixes that address these specific access control weaknesses. Regular security assessments should include evaluation of the PJM Command Center module's access controls and authentication mechanisms to prevent exploitation attempts that could result in significant business disruption or data compromise.