This vulnerability affects Oracle Project Manufacturing component PJM Command Center in version V16. It allows a high privileged attacker who already has logon access to the infrastructure where the product runs to compromise Oracle Project Manufacturing. Successful exploitation can result in unauthorized creation, deletion, or modification of critical or all accessible data within the product. The CVSS vector (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N) indicates local attack vector, high attack complexity, high privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts with no availability impact. The vendor advisory does not explicitly confirm a patch or fix for this vulnerability as of the July 2026 Critical Patch Update. Oracle recommends applying security patches promptly but does not list a specific patch for this issue.

An attacker with high privileges and logon access to the infrastructure can gain unauthorized ability to create, delete, or modify critical data or all data accessible by Oracle Project Manufacturing. This compromises confidentiality and integrity of the data but does not affect availability. The medium severity score reflects the difficulty of exploitation and the requirement for high privileges.

Patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends customers remain on actively supported versions and apply security patches without delay. Since no specific patch is currently identified for this vulnerability, monitor Oracle advisories for updates. Restrict infrastructure access to trusted administrators to reduce risk, as exploitation requires high privileged logon access.