JD Edwards EnterpriseOne CVE-2026-60489

Exploitation requires the attacker to already hold valid low-privileged credentials on JD Edwards EnterpriseOne (PR:L) and network HTTP access to the EnterpriseOne web/HTML server hosting the CRM Foundation component (AV:N). No user interaction is needed (UI:N) and attack complexity is low (AC:L), so once authenticated the attack is straightforward against version 9.2. Limiting factors: the requirement for authentication rules out anonymous internet exploitation, and the affected version is specifically 9.2 with the CRM Foundation component deployed and reachable; the exact vulnerable feature/endpoint within CRM Foundation is not disclosed in the available data.

The signals are moderately strong but not maximal. CVSS 3.1 base is 8.8 (High), driven by network vector, low attack complexity, and no user interaction, with full C/I/A impact - but PR:L means an attacker must already hold valid low-privilege application credentials, which meaningfully narrows the exploiting population versus a PR:N flaw. Oracle characterizes it as 'easily exploitable,' consistent with AC:L. No EPSS score was supplied and no SSVC decision data is available, so automatability and exploitation-maturity cannot be quantified from this input. It is not in CISA KEV and no POC is known, so this is a patch-on-cycle priority (elevated because ERP holds sensitive financial/customer data and any authenticated user could pivot to takeover) rather than a confirmed emergency. Note the tension between the vendor 'Information Disclosure' tag and the C:H/I:H/A:H 'takeover' impact - treat the broader takeover framing as authoritative and verify specifics against Oracle's CPU notes.

A user holding a low-privilege JD Edwards EnterpriseOne account - or an attacker who has phished or otherwise obtained such credentials - sends crafted HTTP requests to the CRM Foundation component over the EnterpriseOne web tier. Exploiting the flaw (low complexity, no user interaction) escalates from limited access to full takeover of the CRM Foundation component, exposing and modifying customer and financial data and disrupting availability. No public exploit code is known at time of analysis, so this would require original exploit development.