What is the CVSS score of CVE-2026-60339?

CVE-2026-60339 has a CVSS 3.1 base score of 3.1 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Oracle Project Manufacturing CVE-2026-60339

EUVD-2026-46754 LOW

Information Exposure (CWE-200)

2026-07-21 secalert_us@oracle.com

GHSA-2cf2-2r93-43gw

Information Disclosure Oracle Project Manufacturing

3.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

3.1 LOW

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

3.1 LOW

Web-accessible HTTP endpoint requires low-privileged credentials (PR:L) and high complexity conditions (AC:H); impact is confidentiality-only, limited in scope, with no integrity or availability consequence.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 09:24 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Project Manufacturing product of Oracle E-Business Suite (component: PJM Command Center). The supported version that is affected is V16. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Project Manufacturing. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Project Manufacturing accessible data. CVSS 3.1 Base Score 3.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N).

AnalysisAI

Unauthorized read access to a subset of project manufacturing data is possible via the PJM Command Center component in Oracle Project Manufacturing V16, exploitable over HTTP by a low-privileged authenticated network attacker. Despite the 'Authentication Bypass' tag from EUVD, the CVSS vector (PR:L) confirms valid credentials are required, indicating the bypass operates at the authorization layer within PJM Command Center rather than bypassing the EBS login mechanism entirely. Exploitation is significantly constrained by high attack complexity (AC:H), the confidentiality impact is limited (C:L), and no public exploit or active exploitation has been identified at time of analysis.

Technical ContextAI

Oracle Project Manufacturing is a specialized module within Oracle E-Business Suite (EBS), used by manufacturing organizations for project-based production planning and tracking. The affected component, PJM Command Center, is a web-based operational dashboard accessible via HTTP within the EBS framework. The vulnerability surfaces as an authorization control weakness - a low-privileged authenticated user may be able to read data outside their intended access scope within the PJM Command Center. No CWE has been assigned by Oracle, which is not uncommon for Oracle CPU disclosures; the 'Authentication Bypass' tag from EUVD likely reflects an improper authorization flaw (analogous to CWE-863 or CWE-284) rather than a true authentication bypass. The CVSS vector is consistent with a web application flaw (AV:N via HTTP) that requires specific exploit conditions to trigger (AC:H), such as particular request sequencing, application state, or parameter manipulation.

RemediationAI

Apply Oracle's Critical Patch Update (CPU) for July 2026, which addresses this vulnerability in Oracle Project Manufacturing V16. The exact patched build or patch number is not independently confirmed beyond the CPU advisory - consult Oracle's advisory at https://www.oracle.com/security-alerts/cpujul2026.html for specific patch identifiers, prerequisites, and installation instructions. Patch available per vendor advisory. As a compensating control prior to patching, restrict network access to the PJM Command Center component to only users with a documented business need, leveraging network-layer controls or EBS application-tier access restrictions; note that this reduces attack surface but does not eliminate the underlying authorization flaw. Additionally, review and tighten Oracle EBS role-based access control assignments for low-privileged accounts with access to the PJM Command Center to minimize the scope of any data accessible via exploitation.