What is the CVSS score of CVE-2026-60492?

CVE-2026-60492 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H. EPSS exploitation probability: 0.4%.

Which versions of JD Edwards EnterpriseOne are affected by CVE-2026-60492?

Oracle JD Edwards EnterpriseOne HCM Foundation 9.2 contains a high-severity vulnerability that allows authenticated users to completely disable HR operations or access sensitive employee data via…

How to fix or mitigate CVE-2026-60492?

Within 24 hours, identify and inventory all Oracle JD Edwards EnterpriseOne HCM Foundation 9.2 instances in your environment and restrict network access to authorized HR and IT personnel only using firewall rules or application-layer controls. Within 7 days, implement detailed logging and real-time alerting on the OW HR PR Foundation component for abnormal access patterns and failed requests; coordinate with your Oracle account team to confirm patch availability timelines and request any interim guidance in CVE-2026-60492 advisories. Within 30 days, establish a change window with HR leadership to deploy any released patch or approved workaround from Oracle, and perform verification testing in a staging environment before production deployment.

JD Edwards EnterpriseOne CVE-2026-60492

EUVD-2026-46870 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-5624-xrqg-pm5v

Privilege Escalation Oracle Jd Edwards Enterpriseone Hcm Foundation

7.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H

vuln.today AI

7.1 HIGH

Network HTTP and 'easily exploitable' give AV:N/AC:L; a low-level account is required so PR:L; full DoS drives A:H, limited data read C:L, no integrity impact I:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 04:17 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 7.1

DescriptionCVE.org

Vulnerability in the JD Edwards EnterpriseOne HCM Foundation product of Oracle JD Edwards (component: OW HR PR Foundation). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne HCM Foundation. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of JD Edwards EnterpriseOne HCM Foundation and unauthorized read access to a subset of JD Edwards EnterpriseOne HCM Foundation accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H).

AnalysisAI

Denial-of-service and information disclosure in Oracle JD Edwards EnterpriseOne HCM Foundation 9.2 (OW HR PR Foundation component) allows a low-privileged, authenticated attacker with network/HTTP access to hang or repeatedly crash the application (complete DoS) and read a subset of accessible data. Oracle rates it CVSS 3.1 7.1 and describes it as 'easily exploitable.' There is no public exploit identified at time of analysis and it is not listed in CISA KEV; no EPSS score was supplied.

Technical ContextAI

The affected component is Oracle's JD Edwards EnterpriseOne HCM (Human Capital Management) Foundation, part of the JD Edwards ERP suite used for human-resources and payroll processing (the 'OW HR PR Foundation' sub-component points to the HR/Payroll foundation layer). The vulnerability is reachable over HTTP through the EnterpriseOne web/HTML server tier. Oracle did not map a CWE (CWE: N/A), but the observed behavior - a triggerable hang/repeatable crash combined with unauthorized read of a data subset - is consistent with an availability-affecting flaw such as uncontrolled resource consumption or an unhandled condition in request/data handling (CWE-400/CWE-664 class) coupled with an access-control or improper-authorization weakness (CWE-284/CWE-863 class) that exposes limited data. No CPE strings were provided in the input; affected scope is defined by Oracle/EUVD as HCM Foundation 9.2 only.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (Patch available per vendor advisory: https://www.oracle.com/security-alerts/cpujul2026.html); an exact fixed build/bundle number was not included in the provided data, so obtain the specific HCM Foundation 9.2 patch from that CPU and My Oracle Support. Because Oracle CPUs are the sole supported remediation path and no standalone patched version string was published in the input, no independently confirmed fix version can be cited here - verify the exact patch on the advisory. Until patched, apply compensating controls: restrict network reachability of the EnterpriseOne HTML/web server so only trusted internal networks and VPN users can reach HTTP endpoints (trade-off: may break remote/self-service HR access), tighten and audit low-privilege application accounts to reduce the pool of attackers who satisfy PR:L (trade-off: administrative overhead), and place a WAF/reverse proxy with rate limiting in front of the web tier to blunt the repeatable-crash DoS (trade-off: tuning needed to avoid blocking legitimate payroll traffic). Given the high availability impact, ensure monitoring/alerting on application-tier crashes and have restart/failover runbooks ready.