CVE-2026-60321: Oracle Project Manufacturing Escalation

CVE-2026-60321 Overview

CVE-2026-60321 affects the Oracle Project Manufacturing product within Oracle E-Business Suite, specifically the PJM Command Center component. The vulnerability impacts supported version V16. Exploitation requires a high-privileged attacker with local logon access to the infrastructure hosting Oracle Project Manufacturing. Successful exploitation allows unauthorized creation, deletion, or modification of critical data, along with unauthorized read access to all Oracle Project Manufacturing accessible data. The confidentiality and integrity impacts are rated high, while availability is not affected.

Critical Impact
A high-privileged local attacker can achieve unauthorized read, write, and delete access to all data accessible through Oracle Project Manufacturing.

Affected Products

Oracle E-Business Suite - Oracle Project Manufacturing
Component: PJM Command Center
Supported version affected: V16

Discovery Timeline

2026-07-21 - CVE-2026-60321 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60321

Vulnerability Analysis

The vulnerability resides in the PJM Command Center component of Oracle Project Manufacturing, part of the broader Oracle E-Business Suite. The PJM Command Center provides dashboards and operational tooling for project-driven manufacturing workflows. A flaw in this component permits a high-privileged local user to bypass intended data protection controls.

The CVSS vector indicates a local attack vector with high attack complexity, requiring high privileges and no user interaction. Scope is unchanged, meaning the impact remains within the vulnerable component's security authority. Confidentiality and integrity impacts are high; availability is not affected.

The EPSS score is 0.117%, reflecting a low probability of exploitation activity in the near term. No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Root Cause

Oracle has not published detailed root cause information. Based on the impact profile, the flaw permits authorized users to access or manipulate data beyond their intended authorization boundary within the PJM Command Center. Refer to the Oracle Critical Patch Update - July 2026 for vendor-provided technical context.

Attack Vector

Exploitation requires the attacker to already possess high privileges and local logon access to the infrastructure where Oracle Project Manufacturing executes. The high attack complexity indicates that specific conditions beyond the attacker's control must be present for successful exploitation. Once these conditions are met, the attacker can read, create, delete, or modify data accessible through Oracle Project Manufacturing.

No verified proof-of-concept code is available. See the Oracle Critical Patch Update advisory for authoritative details.

Detection Methods for CVE-2026-60321

Indicators of Compromise

Unexpected read, create, update, or delete operations against Oracle Project Manufacturing schemas from privileged accounts.
Anomalous PJM Command Center session activity originating from local infrastructure accounts outside normal operational windows.
Database audit records showing bulk access to project manufacturing tables by users whose role should not require such access.

Detection Strategies

Enable and review Oracle E-Business Suite audit logging for the Project Manufacturing module and PJM Command Center pages.
Enable Oracle Database Fine-Grained Auditing (FGA) on sensitive PJM_* tables to capture unusual query patterns.
Correlate operating system login events on hosts running Oracle Project Manufacturing with subsequent application-level activity.

Monitoring Recommendations

Forward Oracle EBS application, database, and OS audit logs to a centralized SIEM for correlation and retention.
Baseline normal PJM Command Center usage per user and alert on deviations in data volume, query type, or access hours.
Monitor privileged account usage on Oracle Project Manufacturing servers and alert on interactive logons outside change windows.

How to Mitigate CVE-2026-60321

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update for Oracle E-Business Suite as soon as change windows allow.
Inventory all Oracle Project Manufacturing V16 deployments and confirm patch status against the Oracle CPU advisory.
Review and reduce the population of accounts holding high privileges on Oracle Project Manufacturing infrastructure.

Patch Information

Oracle addressed CVE-2026-60321 in the July 2026 Critical Patch Update. Administrators should consult the Oracle Critical Patch Update - July 2026 advisory for the specific patch identifiers applicable to Oracle E-Business Suite Oracle Project Manufacturing V16 and follow Oracle's documented application procedure.

Workarounds

Restrict local logon on Oracle Project Manufacturing hosts to a minimal set of vetted administrators until patching is complete.
Enforce separation of duties so that operational accounts cannot both log on to the infrastructure and hold elevated Project Manufacturing roles.
Increase audit logging verbosity for the PJM Command Center and review logs daily until the patch is applied.

bash

# Configuration example: enable Oracle Database auditing for PJM tables
# Run as a DBA in the EBS database
AUDIT SELECT, INSERT, UPDATE, DELETE ON APPS.PJM_ORGANIZATIONS BY ACCESS;
AUDIT SELECT, INSERT, UPDATE, DELETE ON APPS.PJM_PROJECT_PARAMETERS BY ACCESS;

# Review audit trail
SELECT username, obj_name, action_name, timestamp
  FROM dba_audit_trail
 WHERE obj_name LIKE 'PJM\_%' ESCAPE '\'
 ORDER BY timestamp DESC;