CVE-2026-60336: Oracle Project Manufacturing Escalation

CVE-2026-60336 Overview

CVE-2026-60336 affects the PJM Command Center component of Oracle Project Manufacturing, part of Oracle E-Business Suite version V16. The flaw allows a high-privileged attacker with local logon access to the infrastructure running Oracle Project Manufacturing to compromise confidentiality and integrity of application data. Exploitation is difficult and requires local access with elevated privileges, but successful attacks enable unauthorized creation, deletion, or modification of critical data. Attackers can also read all Oracle Project Manufacturing accessible data.

Critical Impact
A local, high-privileged attacker can gain full read and write access to all Oracle Project Manufacturing data, breaking confidentiality and integrity of manufacturing records.

Affected Products

Oracle E-Business Suite - Oracle Project Manufacturing
Component: PJM Command Center
Supported version: V16

Discovery Timeline

2026-07-21 - CVE CVE-2026-60336 published to the National Vulnerability Database
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60336

Vulnerability Analysis

The vulnerability resides in the PJM Command Center, a dashboard component of the Oracle Project Manufacturing module used to manage project-based production workflows. Oracle classifies the issue as difficult to exploit and requiring high privileges, indicating the affected code path is reachable only after an attacker already holds a privileged account on the underlying infrastructure. Once conditions are met, the flaw permits unauthorized reads and writes against critical business data, without affecting availability.

The scope remains unchanged, meaning the impact is contained within the vulnerable Oracle Project Manufacturing component and does not cross authorization boundaries. However, since the compromised data includes all Oracle Project Manufacturing accessible records, the effect on manufacturing integrity, project financials, and inventory tracking is significant.

Root Cause

Oracle has not disclosed the specific root cause in the public advisory. Based on the CVSS metrics and impact profile, the weakness is consistent with an access control or input validation flaw in the PJM Command Center that permits privileged local users to bypass intended data restrictions. Refer to the Oracle Security Alert July 2026 for authoritative technical guidance.

Attack Vector

The attack vector is local. An attacker must authenticate with high privileges on the host infrastructure where Oracle Project Manufacturing runs. From that position, the attacker interacts with the PJM Command Center to manipulate protected data. User interaction is not required, and the attack complexity is high, meaning specific preconditions or timing constraints must be met before exploitation succeeds.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. EPSS data indicates a low near-term exploitation probability.

Detection Methods for CVE-2026-60336

Indicators of Compromise

Unexpected creation, modification, or deletion of Oracle Project Manufacturing records by administrative or service accounts.
Unusual PJM Command Center query volume or bulk data export activity from local sessions.
Privileged local logons to Oracle E-Business Suite application tier hosts outside approved change windows.

Detection Strategies

Enable and review Oracle E-Business Suite auditing (FND_LOG_MESSAGES, sign-on audit) for privileged user activity in the Project Manufacturing module.
Correlate database-level audit logs (Oracle Unified Audit) with operating system authentication events on the E-Business Suite middle tier.
Baseline normal PJM Command Center usage patterns and alert on deviations by account, host, or session duration.

Monitoring Recommendations

Forward Oracle E-Business Suite application, concurrent manager, and database audit logs to a centralized SIEM for retention and correlation.
Monitor changes to APPS-schema objects and Project Manufacturing tables for out-of-band DML from privileged accounts.
Alert on interactive shell logons by applmgr, oracle, or equivalent service accounts on production application tier hosts.

How to Mitigate CVE-2026-60336

Immediate Actions Required

Apply the Oracle Critical Patch Update associated with the Oracle Security Alert July 2026 to all affected Oracle E-Business Suite environments running Project Manufacturing V16.
Inventory hosts running Oracle Project Manufacturing and confirm patch level via adop or Oracle Patch Manager after remediation.
Rotate credentials for high-privileged operating system and database accounts on affected application tier servers.

Patch Information

Oracle addressed CVE-2026-60336 in the July 2026 Critical Patch Update. Administrators should download and apply the Project Manufacturing patch bundle referenced in the Oracle advisory using standard Oracle E-Business Suite patching procedures, including pre-patch backups and post-patch validation of the PJM Command Center.

Workarounds

Restrict interactive and remote logon rights on Oracle E-Business Suite application tier hosts to a minimal set of administrators until patching is complete.
Limit PJM Command Center responsibility assignments to users with documented business need and enforce least privilege on Project Manufacturing roles.
Enforce multi-factor authentication on jump hosts and bastions used to access Oracle E-Business Suite infrastructure.

bash

# Verify applied patch level for Oracle E-Business Suite
# Run as the applmgr user on the application tier
sqlplus apps/<password> <<'SQL'
SELECT bug_number, last_update_date
FROM   ad_bugs
WHERE  bug_number IN ('<CPUJUL2026_PJM_BUG_NUMBER>')
ORDER  BY last_update_date DESC;
SQL