What is the CVSS score of CVE-2026-60346?

CVE-2026-60346 has a CVSS 3.1 base score of 3.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.3%.

JD Edwards EnterpriseOne Tools CVE-2026-60346

EUVD-2026-46760 LOW

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-4wf5-gccf-9m3j

Oracle Denial Of Service Authentication Bypass Jd Edwards Enterpriseone Tools

3.7

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

3.7 LOW

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

vuln.today AI

3.7 LOW

Network vector confirmed via JDENET protocol; AC:H reflects non-trivial exploitation preconditions; no confidentiality or integrity impact per description.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 09:23 vuln.today

DescriptionCVE.org

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability Security). The supported version that is affected is 9.2.26.3. Difficult to exploit vulnerability allows unauthenticated attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).

AnalysisAI

Partial denial of service in JD Edwards EnterpriseOne Tools 9.2.26.3 is achievable by an unauthenticated remote attacker via the JDENET protocol, specifically through the Interoperability Security component. The vulnerability carries a low CVSS base score of 3.7 driven by high attack complexity and limited availability-only impact, with no confidentiality or integrity consequences. No public exploit code or active exploitation has been identified at time of analysis, placing this at low operational priority for most organizations.

Technical ContextAI

JD Edwards EnterpriseOne Tools is Oracle's foundational ERP platform layer, and the affected component - Interoperability Security - governs how the platform authenticates and manages communication with external systems. JDENET is Oracle JD Edwards' proprietary inter-process and inter-server communication protocol, typically used for internal enterprise network traffic between JD Edwards servers and clients. The vulnerability surfaces in this protocol handler within the Interoperability Security component on version 9.2.26.3. No CWE classification was provided in the available intelligence, so the specific root cause class - such as improper input validation, resource exhaustion, or protocol parsing flaw - cannot be confirmed from available data. The CPE-specific affected version is JD Edwards EnterpriseOne Tools 9.2.26.3, as confirmed in Oracle's CPU July 2026 advisory.

RemediationAI

Apply Oracle's Critical Patch Update (CPU) for July 2026 to address this vulnerability; the advisory is available at https://www.oracle.com/security-alerts/cpujul2026.html. An exact patched version number beyond the CPU reference is not independently confirmed from the available data, so consult the Oracle advisory for the specific target release. As a compensating control prior to patching, restrict network access to the JDENET protocol port using firewall rules or network segmentation so that only trusted internal hosts can reach the JD Edwards EnterpriseOne server - this directly removes the unauthenticated network attack surface and is consistent with least-privilege network architecture. Note that overly restrictive JDENET blocking may impact JD Edwards inter-server communication and should be validated in a non-production environment before deployment.