This vulnerability affects Oracle Project Manufacturing component PJM Command Center in version V16. It requires a high privileged attacker who already has logon access to the infrastructure where the product runs. Successful exploitation can result in unauthorized access to critical or all accessible data and unauthorized data modification. The CVSS vector (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N) indicates local attack vector, high attack complexity, high privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. The vendor advisory (Oracle Critical Patch Update July 2026) does not explicitly list a patch for this vulnerability at this time. Oracle strongly recommends applying available patches from their Critical Patch Updates to mitigate vulnerabilities.

An attacker with high privileges and logon access to the infrastructure can gain unauthorized access to critical or all Oracle Project Manufacturing accessible data. Additionally, the attacker can perform unauthorized update, insert, or delete operations on some accessible data. This compromises confidentiality and partially impacts data integrity. There is no impact on availability. The vulnerability is rated medium severity with a CVSS score of 4.7.

Patch status is not yet confirmed — check the Oracle Critical Patch Update July 2026 advisory for current remediation guidance: https://www.oracle.com/security-alerts/cpujul2026.html. Oracle recommends that customers remain on actively-supported versions and apply security patches without delay. Since no specific patch or temporary fix is currently indicated for Oracle Project Manufacturing V16 in the advisory, monitor Oracle's updates closely and apply any forthcoming patches promptly.