EUVD-2026-46736
GHSA-26vw-x9gc-wwhq
Severity by source
AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N
Local infrastructure access and pre-existing high privileges are required; no availability impact is described; C:H and I:H reflect full data read and write access within the application.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the Oracle Project Manufacturing product of Oracle E-Business Suite (component: PJM Command Center). The supported version that is affected is V16. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Project Manufacturing executes to compromise Oracle Project Manufacturing. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Project Manufacturing accessible data as well as unauthorized access to critical data or complete access to all Oracle Project Manufacturing accessible data. CVSS 3.1 Base Score 5.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N).
AnalysisAI
Oracle Project Manufacturing V16 (PJM Command Center component) exposes a local privilege-abuse flaw allowing a high-privileged attacker with infrastructure logon access to bypass authorization controls and gain unauthorized read and write access to all Project Manufacturing data. The CVSS vector (AV:L/AC:H/PR:H) constrains real-world risk significantly - exploitation requires existing elevated access on the host infrastructure and high attack complexity. No public exploit code and no CISA KEV listing have been identified at time of analysis, keeping this vulnerability in a watchlist rather than emergency-response category for most organizations.
Technical ContextAI
The affected component is the PJM Command Center within Oracle E-Business Suite's Project Manufacturing module, identified in CPE as cpe:2.3:a:oracle_corporation:oracle_project_manufacturing:*:*:*:*:*:*:*:*. Oracle E-Business Suite is a large enterprise resource planning (ERP) suite; the Project Manufacturing module handles project costing, planning, and execution workflows. Although CWE is listed as N/A by NVD, the vendor-supplied tags classify this as an Authentication Bypass, suggesting that the flaw undermines internal access control or session/privilege verification within PJM Command Center rather than a memory-safety or injection issue. The local attack vector (AV:L) indicates the vulnerability is exercised at the operating system or application-server layer where Oracle EBS executes, not via a remotely exposed network interface.
RemediationAI
Apply Oracle's Critical Patch Update (CPU) for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle CPUs are cumulative, so applying the July 2026 CPU to affected Oracle E-Business Suite V16 installations is the primary remediation path. No specific patched build version number was included in the available intelligence data - the exact post-patch version should be confirmed against the Oracle advisory directly. As a compensating control while patching is scheduled, restrict logon access to the infrastructure hosts where Oracle EBS executes to the minimum required set of administrators; reducing the pool of accounts with local high-privilege access directly limits who could satisfy the PR:H and AV:L prerequisites. Audit PJM Command Center access logs for anomalous data access patterns in the interim. Note that restricting network connectivity will not mitigate this flaw, given its local attack vector.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today