CVE-2026-60338: Oracle Project Manufacturing Auth Bypass

CVE-2026-60338 Overview

CVE-2026-60338 affects the Oracle Project Manufacturing product within Oracle E-Business Suite, specifically the PJM Command Center component. The affected supported version is V16. A low-privileged attacker with logon access to the infrastructure where Oracle Project Manufacturing executes can exploit this flaw, though successful exploitation is difficult.

Successful attacks allow unauthorized update, insert, or delete access to a subset of Oracle Project Manufacturing data. The flaw also enables a partial denial of service against the application. Oracle disclosed the issue in the July 2026 Critical Patch Update.

Critical Impact
Local low-privileged attackers can tamper with a subset of Oracle Project Manufacturing data and trigger a partial denial of service against the PJM Command Center.

Affected Products

Oracle E-Business Suite
Oracle Project Manufacturing V16
PJM Command Center component

Discovery Timeline

2026-07-21 - CVE CVE-2026-60338 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60338

Vulnerability Analysis

The vulnerability resides in the PJM Command Center component of Oracle Project Manufacturing, part of Oracle E-Business Suite. The attack surface is local, requiring the attacker to hold valid low-privileged credentials on the infrastructure hosting the application. Attack complexity is high, indicating conditions outside the attacker's control must be present for reliable exploitation.

Impact is limited to integrity and availability. Confidentiality is not affected. An attacker who succeeds can modify, insert, or delete a subset of application data accessible to Oracle Project Manufacturing. The same conditions permit a partial denial of service against the component, degrading rather than fully halting service.

The EPSS probability is 0.09% with a percentile of 0.59, reflecting a low likelihood of near-term exploitation activity. No public proof-of-concept code or in-the-wild exploitation has been reported.

Root Cause

Oracle has not published a detailed root cause analysis in the July 2026 Critical Patch Update advisory. The affected code path sits within the PJM Command Center module and permits authenticated local users to influence data operations that should be restricted by application-layer authorization controls.

Attack Vector

Exploitation requires local logon access to the server infrastructure running Oracle Project Manufacturing. The attacker must already hold a low-privilege account. No user interaction from another party is required. Because attack complexity is high, exploitation depends on specific configuration or timing conditions rather than a single reliable primitive.

No verified exploitation code is publicly available. Refer to the Oracle Security Alert July 2026 for vendor-supplied technical detail.

Detection Methods for CVE-2026-60338

Indicators of Compromise

Unexpected insert, update, or delete operations against Oracle Project Manufacturing tables performed by low-privileged local accounts.
Repeated failed or anomalous requests to the PJM Command Center that correlate with brief periods of application unresponsiveness.
Local logon events from service or batch accounts that historically do not interact with Oracle E-Business Suite hosts.

Detection Strategies

Enable Oracle E-Business Suite audit trails on Project Manufacturing tables and review changes performed outside standard business workflows.
Correlate operating system logon events on Oracle E-Business Suite hosts with subsequent database session activity attributed to the same principal.
Baseline normal PJM Command Center transaction volumes and alert on statistical deviations that could indicate a partial denial-of-service attempt.

Monitoring Recommendations

Forward Oracle E-Business Suite application logs, database audit records, and host authentication logs to a centralized SIEM for correlation.
Monitor privileged and low-privileged account activity on Oracle Project Manufacturing infrastructure for lateral movement patterns.
Track availability metrics for the PJM Command Center and generate alerts when response times or error rates exceed established thresholds.

How to Mitigate CVE-2026-60338

Immediate Actions Required

Apply the July 2026 Critical Patch Update from Oracle to all Oracle E-Business Suite environments running Project Manufacturing V16.
Inventory all systems running the PJM Command Center component and prioritize patch deployment based on data sensitivity.
Review and tighten local logon rights on Oracle E-Business Suite application and database servers.

Patch Information

Oracle addressed CVE-2026-60338 in the July 2026 Critical Patch Update. Administrators should download and apply the fixes documented in the Oracle Security Alert July 2026. Follow Oracle's standard patch validation process in a non-production environment before rolling out to production instances.

Workarounds

Restrict interactive and remote logon on Oracle E-Business Suite infrastructure to a minimal set of administrators until patches are applied.
Limit user access to the PJM Command Center responsibility to personnel with a documented business need.
Increase audit logging verbosity on Oracle Project Manufacturing schemas to shorten detection time for unauthorized data modification.

bash

# Configuration example: restrict interactive logon on Oracle EBS hosts (Linux)
# Review /etc/security/access.conf and permit only required admin groups
-:ALL EXCEPT ebs_admins wheel:ALL

# Enable database auditing on Project Manufacturing tables (Oracle SQL*Plus)
AUDIT INSERT, UPDATE, DELETE ON PA.PJM_ORG_PARAMETERS BY ACCESS;