Listen to this Post
How CVE-2026-60338 Works
CVE-2026-60338 is a vulnerability discovered in the Oracle Project Manufacturing product, which is a component of the Oracle E-Business Suite. The flaw resides specifically within the PJM Command Center component of the software. The affected version is Oracle Project Manufacturing V16.
The vulnerability is classified as a privilege management issue, stemming from the application’s failure to properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control. This weakness is mapped to CWE-269 (Improper Privilege Management).
An attacker must meet several conditions to exploit this flaw. The attack vector is local (AV:L), meaning the attacker must have logon access to the infrastructure where Oracle Project Manufacturing is executed. The attacker requires low privileges (PR:L) on the target system, and the attack complexity is high (AC:H), indicating that successful exploitation depends on conditions beyond the attacker’s control. No user interaction is required (UI:N).
Once exploited, the vulnerability can lead to two primary outcomes. First, it allows the attacker to perform unauthorized update, insert, or delete operations on some of the data accessible to Oracle Project Manufacturing. Second, it grants the attacker the ability to cause a partial denial of service (partial DOS) of the Oracle Project Manufacturing application. The vulnerability does not impact confidentiality (C:N), but it does have low impacts on integrity (I:L) and availability (A:L).
The CVSS 3.1 Base Score for this vulnerability is 3.6, which is considered Low severity. The CVSS vector string is CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L. According to the EPSS (Exploit Prediction Scoring System), the probability of exploitation is very low, with a score of 0.0009.
The vulnerability was published on July 21, 2026, and the CVE ID was reserved on July 8, 2026. The vendor, Oracle, is the assigner of this CVE. Currently, no public exploit is available, and the technical details are not publicly disclosed. The estimated price for an exploit on the black market is between $5,000 and $25,000 USD.
DailyCVE Form
Platform: Oracle E-Business Suite
Version: V16
Vulnerability: Privilege Management
Severity: Low (CVSS 3.6)
Date: 2026-07-21
Prediction: 2026-08-15
What Undercode Say
Analytics
The vulnerability targets the PJM Command Center, a core management interface for manufacturing projects. Due to its low severity and requirement for local access with high attack complexity, widespread exploitation is not anticipated. However, organizations with exposed internal networks or insider threat risks should prioritize patching. The vulnerability is part of Oracle’s July 2026 Critical Patch Update, which addressed 1,235 CVEs with 1,449 patches. Oracle E-Business Suite received the highest number of patches (410) in this update.
Bash Commands and Codes
To check if your Oracle Project Manufacturing instance is vulnerable, you can use the following SQL query to verify the version:
SELECT FROM PRODUCT_COMPONENT_VERSION WHERE PRODUCT LIKE '%Project Manufacturing%';
To identify if the PJM Command Center component is present and its configuration:
SELECT COMPONENT_NAME, COMPONENT_VERSION, STATUS FROM FND_PRODUCT_COMPONENTS WHERE COMPONENT_NAME LIKE '%PJM%';
To check for unauthorized data modifications that might indicate exploitation:
SELECT FROM FND_LOG_MESSAGES WHERE MODULE LIKE '%PJM%' AND MESSAGE_TEXT LIKE '%UPDATE%' OR MESSAGE_TEXT LIKE '%DELETE%' OR MESSAGE_TEXT LIKE '%INSERT%';
Exploit
The vulnerability requires a local, low-privileged attacker to log on to the infrastructure hosting Oracle Project Manufacturing. The attacker must then interact with the PJM Command Center component in a specific, yet undisclosed, manner to manipulate privileges. As technical details are not publicly available, and no exploit is known to exist, the exact exploitation steps remain unknown. The attack technique is mapped to MITRE ATT&CK T1068 (Privilege Escalation).
Protection
Oracle has released a security patch for CVE-2026-60338 as part of its July 2026 Critical Patch Update. Organizations should apply this patch immediately to vulnerable instances of Oracle Project Manufacturing V16. If patching is not immediately possible, restrict local access to the Oracle E-Business Suite infrastructure and monitor the PJM Command Center logs for any unauthorized or suspicious activities. The vendor suggests considering replacement of the affected object with an alternative product if feasible.
Impact
Successful exploitation of CVE-2026-60338 allows an attacker with local, low-privileged access to:
– Perform unauthorized updates, inserts, or deletions on some Oracle Project Manufacturing data.
– Cause a partial denial of service (partial DOS) of the Oracle Project Manufacturing application.
The impact is limited to integrity and availability, with no effect on confidentiality. The overall severity is Low, with a CVSS Base Score of 3.6. The vulnerability does not allow for remote code execution or complete system compromise.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
