EUVD-2026-46753
GHSA-vpw9-jq57-349g
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L
Local vector and low privilege require infrastructure logon; high complexity reflects non-trivial exploitation; no confidentiality impact is described or implied.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the Oracle Project Manufacturing product of Oracle E-Business Suite (component: PJM Command Center). The supported version that is affected is V16. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Project Manufacturing executes to compromise Oracle Project Manufacturing. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Project Manufacturing accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Project Manufacturing. CVSS 3.1 Base Score 3.6 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L).
AnalysisAI
Oracle Project Manufacturing V16's PJM Command Center component exposes a low-severity local vulnerability requiring infrastructure-level access and high attack complexity. A low-privileged attacker with logon access to the host infrastructure can, under difficult exploitation conditions, perform unauthorized data modification or deletion against accessible Project Manufacturing records and induce a partial denial of service against the component. No public exploit code exists and this CVE is not listed in CISA's Known Exploited Vulnerabilities catalog, placing practical risk well below the already-low CVSS score of 3.6 suggests.
Technical ContextAI
Oracle Project Manufacturing (PJM) is a module within Oracle E-Business Suite (EBS) used by manufacturing organizations to integrate project management with shop floor and supply chain operations. The affected component, PJM Command Center, is a dashboard-style interface for monitoring and managing manufacturing project data. The affected version is V16 of Oracle E-Business Suite. No CWE is assigned by Oracle or NVD for this entry, preventing definitive root-cause classification; however, the combination of local access vector, high complexity, and integrity/availability-only impact is consistent with a privilege escalation or race-condition class flaw within the application's command processing layer. The CVSS vector (AV:L/AC:H/PR:L) confirms the vulnerability is exploitable only by an authenticated, locally-present user under non-trivial conditions.
RemediationAI
Apply the Oracle Critical Patch Update released in July 2026, referenced at https://www.oracle.com/security-alerts/cpujul2026.html, which addresses this vulnerability in Oracle E-Business Suite V16. An exact patched version number was not independently confirmed in the available data beyond the CPU advisory reference. As a compensating control where patching is delayed, restrict logon access to the infrastructure hosts running Oracle Project Manufacturing to only those users who require it operationally, reducing the pool of accounts that could satisfy the AV:L/PR:L prerequisites. Additionally, monitor EBS application logs for anomalous data modification activity in Project Manufacturing tables. Note that access restriction does not eliminate the vulnerability but does reduce the attacker population to authorized infrastructure personnel.
More in Project Manufacturing
View allLocal privilege abuse in Oracle Project Manufacturing V16 (PJM Command Center component of Oracle E-Business Suite) enab
Local privilege abuse in Oracle Project Manufacturing V16 (PJM Command Center component, part of Oracle E-Business Suite
Unauthorized read access to a subset of project manufacturing data is possible via the PJM Command Center component in O
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today