What is the CVSS score of CVE-2026-60336?

CVE-2026-60336 has a CVSS 3.1 base score of 5.7 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Oracle Project Manufacturing CVE-2026-60336

EUVD-2026-46751 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-j74h-g5j6-q3xj

Authentication Bypass Oracle Project Manufacturing

5.7

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

5.7 MEDIUM

AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

5.7 MEDIUM

Local-only vector confirmed by description; PR:H required per Oracle; AC:H reflects difficult exploitation conditions; no availability impact stated.

3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N

4.0 AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 09:25 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Project Manufacturing product of Oracle E-Business Suite (component: PJM Command Center). The supported version that is affected is V16. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Project Manufacturing executes to compromise Oracle Project Manufacturing. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Project Manufacturing accessible data as well as unauthorized access to critical data or complete access to all Oracle Project Manufacturing accessible data. CVSS 3.1 Base Score 5.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Local privilege abuse in Oracle Project Manufacturing V16 (PJM Command Center component of Oracle E-Business Suite) enables a high-privileged attacker with local infrastructure access to achieve unauthorized read and write access to critical application data. Despite the 'Authentication Bypass' tag in intelligence sources, the CVSS vector explicitly requires high privileges (PR:H) and local access (AV:L), suggesting the bypass operates within application-layer authorization controls rather than at the authentication perimeter. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.

Technical ContextAI

Oracle Project Manufacturing is a module within Oracle E-Business Suite (EBS) responsible for managing manufacturing-related project data. The affected component is the PJM Command Center, a dashboard and operational interface within the suite. The vulnerability is scoped to version V16. CWE classification is not assigned by the reporter, but the 'Authentication Bypass' tag suggests an access control or authorization flaw - possibly a privilege escalation or insecure direct object reference within the Command Center - that allows a high-privileged OS-level user to cross application-layer authorization boundaries and access or modify data beyond their intended scope. The CVSS vector AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N indicates the attack is confined to the local host where EBS executes, requires specific conditions to trigger (AC:H), and does not affect system availability. The absence of an assigned CWE limits root-cause classification, but the combination of local access and high complexity is consistent with a race condition, configuration manipulation, or internal API misuse.

RemediationAI

Apply the Oracle Critical Patch Update (CPU) for July 2026, referenced at https://www.oracle.com/security-alerts/cpujul2026.html, which addresses this vulnerability in Oracle Project Manufacturing V16. Oracle does not publicly disclose exact patch version identifiers in CPU advisories; customers should consult My Oracle Support (MOS) for the specific patch number applicable to their E-Business Suite installation. As a compensating control pending patch application, restrict local logon access to the infrastructure host running Oracle Project Manufacturing to the minimum required set of privileged accounts, using OS-level access controls and auditing. Additionally, review and tighten application-level role assignments within PJM Command Center to limit which users hold high-privileged roles. Note that restricting OS-level access may affect legitimate administrative workflows and should be coordinated with operations teams.