JD Edwards EnterpriseOne CVE-2026-60494

Exploitation requires network access to the JD Edwards EnterpriseOne General Ledger application over HTTP (its web/HTML server tier running the E1 Foundation component) on the affected version 9.2; no authentication and no user interaction are needed (PR:N/UI:N). The principal limiting factor is high attack complexity (AC:H) - Oracle characterizes the flaw as 'difficult to exploit,' implying conditions outside the attacker's control (timing, specific state, or non-deterministic triggering) must align for a successful attack, so it is not a reliable one-shot exploit against every reachable instance. Exposure is further limited to deployments where the JD Edwards HTTP endpoint is reachable by the attacker.

The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H, score 7.0) is the strongest signal available: network-reachable and unauthenticated (PR:N/UI:N) raises exposure, but high attack complexity (AC:H) - Oracle explicitly labels it 'difficult to exploit' - meaningfully lowers the practical likelihood of reliable, at-scale attacks. No EPSS probability, no KEV entry, and no POC were provided, so there is no evidence of active or imminent exploitation; the dominant impact is availability (complete DOS) with only partial confidentiality and integrity loss. Net: this is a legitimate patch-priority item for JD Edwards operators because it is unauthenticated and network-facing, but the AC:H condition and absence of any exploitation signal place it below unauthenticated-easy-RCE flaws. Key data gap: EPSS and CWE are missing, and no independent exploit maturity assessment exists - treat likelihood as inferred from AC:H alone.

An attacker with network reachability to an internet- or intranet-exposed JD Edwards EnterpriseOne HTML server sends specially crafted HTTP requests to the General Ledger/E1 Foundation endpoints, triggering a hang or repeatable crash that takes the General Ledger offline (complete DOS) and, in the process, gains limited unauthorized read and modify access to a subset of GL data. The high attack complexity means the attacker likely needs specific timing, conditions, or repeated attempts to succeed reliably. No public exploit identified at time of analysis.