JD Edwards EnterpriseOne CVE-2026-60490

Exploitation requires network access to the JD Edwards EnterpriseOne CRM Foundation HTTP interface and a valid low-privileged account (CVSS PR:L), so this is authenticated abuse, not anonymous remote takeover. The specific affected surface is the CRM Foundation component of EnterpriseOne 9.2; no non-default feature toggle or special configuration is named in the description, so any standard 9.2 deployment exposing the web tier to the attacker is at risk. Limiting factors: the attacker must first hold valid credentials, exploitation is confined to version 9.2 CRM Foundation, and reachability depends on whether the JDE web tier is exposed to the attacker's network position - internet-facing deployments are far more exposed than those restricted to an internal segment or VPN.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8 High) is internally consistent and points to a genuinely serious issue: network reachable, low attack complexity, only low privileges required, no user interaction, and full impact to all three security properties. Countervailing signals temper urgency: no EPSS score was provided, the CVE is not listed in CISA KEV (no confirmed active exploitation), and no public POC was identified, so this is a high-severity-but-not-yet-exploited item rather than an emergency. The PR:L requirement is the key limiter - an attacker must already possess a valid, if minimal, JDE account, which reduces the pool of would-be attackers to insiders or those who have obtained credentials. No SSVC decision data was supplied. Net: prioritize patching for internet-exposed or broadly-accessible JDE deployments, but the credential prerequisite makes this a high, not critical, real-world priority absent evidence of exploitation.

An attacker who has obtained or been issued a low-privilege JD Edwards user account authenticates to the EnterpriseOne web interface and sends crafted HTTP requests to the CRM Foundation component, exploiting the flaw to act beyond their authorized scope and gain full control over CRM Foundation data and functions. Because attack complexity is low and no user interaction is needed, the request can be scripted and repeated; no public POC is currently known, so an attacker would need to develop the technique independently.