JD Edwards EnterpriseOne CVE-2026-60495

Exploitation requires network access to the proprietary JDENET protocol/service of JD Edwards EnterpriseOne Requirements Planning 9.2, plus valid low-level privileges (PR:L) - the attacker must already be authenticated to the JDE environment at a low privilege tier. Limiting factors: the CVSS vector marks AC:H, so success depends on conditions outside the attacker's control (e.g., specific timing, state, or configuration), making reliable exploitation difficult; only version 9.2 of the Requirements Planning component is in scope; and JDENET is typically an internal server-to-server transport, so exploitation presumes the attacker can reach that service. No user interaction is required (UI:N).

The signals are mixed and point to a genuine-but-not-emergency priority. The CVSS 3.1 score of 7.5 (High) is tempered by two limiting metrics: AC:H (high attack complexity, meaning conditions outside the attacker's control must be met) and PR:L (the attacker must already hold low-level authenticated access to the JDE environment). Against this, the impact is maximal (C:H/I:H/A:H, described by Oracle as full takeover) and the vector is network-reachable (AV:N) with no user interaction (UI:N). There is no EPSS score, KEV listing, or POC in the provided data, so real-world exploitation likelihood appears low today. The Oracle 'Information Disclosure' tag conflicts with the full C/I/A impact in the CVSS vector - treat the vector as authoritative and verify scope with Oracle. Net: schedule remediation in the normal Oracle CPU cycle rather than emergency-patching, unless JDENET is exposed beyond trusted internal networks.

An attacker who already holds a low-privilege foothold on the internal network - for example a compromised low-level JDE user account or a machine with JDENET connectivity - sends specially crafted JDENET messages to the Requirements Planning server. By meeting the specific timing or state conditions implied by the high attack complexity, the attacker escalates the interaction into a full takeover of the Requirements Planning component, impacting its confidentiality, integrity, and availability. No public exploit is identified at time of analysis, so this would require original exploit development.