CVE WatchOct 24, 2026

CVE-2026-60337

Vulnerability in the Oracle Project Manufacturing product of Oracle E-Business Suite (component: PJM Command Center). The supported versio

CVSS

4.7

Medium

EPSS

0.1%

KEV

—

Exploit Today

0-100

Published: Jul 21, 2026 · Last modified: Oct 24, 2026 · CWE-284

EPSS · 30d

0.1%EPSS · 30 days0.1%

2026-09-282026-10-26

Technical description

Vulnerability in the Oracle Project Manufacturing product of Oracle E-Business Suite (component: PJM Command Center). The supported version that is affected is V16. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Project Manufacturing executes to compromise Oracle Project Manufacturing. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Project Manufacturing accessible data as well as unauthorized update, insert or delete access to some of Oracle Project Manufacturing accessible data. CVSS 3.1 Base Score 4.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N).

Official references

www.oracle.comhttps://www.oracle.com/security-alerts/cpujul2026.html

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-829864.6 MED

—

———The user in a group can bypass the group restriction set by an administrator on link sharing, creating share links for a table even though they shouldn't have that permission.4h CVE-2026-829844.3 MED

—

———When a team was configured as "visible to everyone", the web UI correctly blocked non-members from viewing the team ("You are not a member of ..."), but the resources API endpoint could still be called directly, allowing any authenticated non-member to enumerate the team's internal resources and their identifiers. This does not grant access to the contents of the discovered resources themselves, only their existence, names, and identifiers.4h CVE-2026-771734.3 MED

—

———A user could create a docx or odt file with a # in the filename with confidential information such as a credit card number and have it not be marked as confidential.4h CVE-2026-771713.5 LOW

—

———A public shared collective always allowed recipients of the link to create pages.4h CVE-2026-674003.5 LOW

—

———A missing token type check allowed to retrieve more additional information about the WOPI configuration with a user or guest token.4h CVE-2026-1175127.3 HIG

—

———A vulnerability was found in oretnom23 php-travel-agency-system. This affects an unknown part of the file admin/employee_insert.php. Performing a manipulation of the argument employee photo results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.4h