Quick answers
- Is CVE-2026-60338 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-60338 being exploited in the wild.
- How severe is CVE-2026-60338?
- Low severity, with a CVSS score of 3.6, published 21 July 2026.
- Which products and versions are affected?
- Oracle Project Manufacturing V16.
- Is there a fix for CVE-2026-60338?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-60338 attacked?
- It is attacked with local access, in a network appliance.
- Am I affected by CVE-2026-60338?
- Check whether you run Oracle Project Manufacturing at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This vulnerability affects the PJM Command Center component within Oracle Project Manufacturing (Oracle E-Business Suite) version V16. It is classified as difficult to exploit, requiring a low-privileged attacker to have local logon access to the infrastructure where the software executes. Successful exploitation allows an attacker to perform unauthorized updates, insertions, or deletions of accessible data, and can lead to a partial denial of service (DoS). The vulnerability is tracked via Oracle's July 2026 Critical Patch Update, and users are advised to apply the relevant security patches provided by the vendor.
Affected products
- Oracle Project Manufacturing (PJM Command Center) V16
Timeline
- 2026-07-21: disclosed: Initial publication of CVE-2026-60338 by Oracle.
- 2026-07-21: advisory: Included in Oracle Critical Patch Update Advisory - July 2026.