What is the CVSS score of CVE-2026-60495?

CVE-2026-60495 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of JD Edwards EnterpriseOne are affected by CVE-2026-60495?

Oracle JD Edwards EnterpriseOne Requirements Planning 9.2 contains a high-severity vulnerability (CVSS 7.5) enabling authenticated low-privilege users to achieve full system compromise.

How to fix or mitigate CVE-2026-60495?

Within 24 hours: identify and document all systems running Requirements Planning module on EnterpriseOne 9.2; immediately restrict JDENET protocol access to authorized administrators only. Within 7 days: implement network segmentation isolating JDENET communications from standard users and enable comprehensive logging of JDENET traffic. Within 30 days: initiate contact with Oracle for patched version availability and establish a remediation timeline; if no patch is forthcoming within 90 days, evaluate alternative ERP solutions or implement air-gapped architecture.

JD Edwards EnterpriseOne CVE-2026-60495

EUVD-2026-46873 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-07-21 secalert_us@oracle.com

GHSA-m2xp-8g7r-h7gf

Authentication Bypass Oracle Jd Edwards Enterpriseone Requirements Planning

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Network-reachable JDENET (AV:N) but hard to trigger (AC:H) and requires an existing low-privilege JDE account (PR:L); full takeover justifies C:H/I:H/A:H with unchanged scope.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 04:18 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the JD Edwards EnterpriseOne Requirements Planning product of Oracle JD Edwards (component: Requirements Planning). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Requirements Planning. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Requirements Planning. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle JD Edwards EnterpriseOne Requirements Planning 9.2 is possible for a low-privileged attacker reaching the proprietary JDENET network protocol, yielding confidentiality, integrity, and availability impact ("takeover"). The flaw carries a CVSS 3.1 base score of 7.5 but is rated hard to exploit (AC:H) and requires existing low-level privileges (PR:L). There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

The affected component is Oracle JD Edwards EnterpriseOne, an enterprise ERP suite, specifically its Requirements Planning (MRP/DRP) module at version 9.2. Exploitation occurs over JDENET, the proprietary TCP-based messaging/communication middleware that brokers traffic between JD Edwards enterprise servers, application servers, and clients. Because JDENET is the internal transport for JDE server processes, an attacker must be able to send messages to that service. No CWE was assigned by NVD (CWE: N/A), so the precise root-cause class is not formally categorized; Oracle tags the issue under Information Disclosure, though the CVSS vector indicates full C/I/A impact rather than disclosure alone.

RemediationAI

Apply the fixes delivered in the Oracle July 2026 Critical Patch Update (Patch available per vendor advisory; no discrete fix version is enumerated in the provided data - consult the CPU matrix for the exact patch/ESU level for EnterpriseOne 9.2) at https://www.oracle.com/security-alerts/cpujul2026.html. Because exploitation is over JDENET and requires network reachability plus low privileges, effective compensating controls until patching are to restrict JDENET port access (place enterprise, application, and logic servers on a segmented management network and firewall JDENET so only trusted JD Edwards server hosts can connect), tighten and review low-privilege user accounts that can authenticate to the environment, and monitor JDENET traffic for anomalous messages. The trade-off of network segmentation is potential disruption to distributed JDE server-to-server communication, so validate connectivity between kernel processes after restricting ports.