What is the CVSS score of EUVD-2026-46752?

EUVD-2026-46752 has a CVSS 3.1 base score of 4.7 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.1%.

Oracle Project Manufacturing EUVD-2026-46752

| CVE-2026-60337 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-wrq4-gwp6-fhxv

Authentication Bypass Oracle Project Manufacturing

4.7

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

4.7 MEDIUM

AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N

vuln.today AI

4.7 MEDIUM

Vendor-provided vector is consistent with description: local infrastructure access required, high privileges needed, high complexity, no availability impact.

3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N

4.0 AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 09:25 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Project Manufacturing product of Oracle E-Business Suite (component: PJM Command Center). The supported version that is affected is V16. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Project Manufacturing executes to compromise Oracle Project Manufacturing. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Project Manufacturing accessible data as well as unauthorized update, insert or delete access to some of Oracle Project Manufacturing accessible data. CVSS 3.1 Base Score 4.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N).

AnalysisAI

Local privilege abuse in Oracle Project Manufacturing V16 (PJM Command Center component, part of Oracle E-Business Suite) permits a highly privileged, locally authenticated attacker to bypass access controls and gain unauthorized read access to all Oracle Project Manufacturing data as well as limited write access. The CVSS vector (AV:L/AC:H/PR:H) confirms this is neither remotely exploitable nor accessible to low-privileged users, substantially constraining real-world impact despite the High confidentiality impact rating. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog at time of analysis.

Technical ContextAI

Oracle Project Manufacturing is a module within Oracle E-Business Suite (EBS) that supports project-based manufacturing operations, including cost management, planning, and execution. The vulnerable component is the PJM Command Center, a centralized interface for managing project manufacturing activities. The CWE is listed as N/A by the vendor, though the 'Authentication Bypass' tag from ENISA EUVD (EUVD-2026-46752) indicates a likely authorization or access control enforcement flaw - potentially allowing a high-privileged user to exceed their permitted data scope. The local attack vector (AV:L) means exploitation requires an attacker to already have an OS-level or application-level session on the infrastructure hosting Oracle Project Manufacturing. Affected version is confirmed as V16 by both the Oracle CPU July 2026 advisory and the ENISA EUVD listing; no CPE strings were provided.

RemediationAI

Apply the Oracle Critical Patch Update for July 2026, available via the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html. An exact patched version number is not independently confirmed beyond the CPU advisory reference - consult Oracle Support or My Oracle Support (MOS) for the specific patch ID applicable to Oracle E-Business Suite V16 environments. As a compensating control prior to patching, restrict local and infrastructure-level logon access to Oracle Project Manufacturing servers to the absolute minimum set of accounts, audit and reduce high-privileged user accounts with local system access, and review audit logging on the PJM Command Center component to detect anomalous data access patterns. Note that restricting local OS access may affect scheduled jobs and DBA workflows - assess operational impact before enforcement.