JD Edwards EnterpriseOne CVE-2026-60496

Exploitation requires: (1) network access to the JDENET protocol listener of an EnterpriseOne server running the Advanced Pricing - Procurement module at version 9.2; and (2) valid low-privilege authentication to the environment (CVSS PR:L - this is NOT unauthenticated). Limiting factors that reduce realistic risk: the high attack complexity (AC:H) means success depends on conditions outside the attacker's full control (specific state, race, or configuration); no user interaction is needed (UI:N), but working exploit code must be developed from scratch because none is public; and reachability is constrained to hosts where JDENET ports are exposed to the attacker. Only the JD Edwards EnterpriseOne 9.2 line with the Advanced Pricing - Procurement component is stated as affected.

The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.5 High) signals a network-reachable but hard-to-exploit issue that requires pre-existing low-level privileges. The high attack complexity (AC:H) and authentication requirement (PR:L) materially lower real-world risk relative to a raw 7.5, pointing toward targeted rather than mass exploitation. No EPSS score was provided, there is no KEV listing, and no POC is known - all three signals argue against imminent widespread exploitation. A conflict worth verifying: the intelligence tags label this 'Information Disclosure,' yet the description and impact metrics describe full 'takeover' with C:H/I:H/A:H, so the tag understates the true impact - trust the CVSS impact metrics over the tag. No SSVC decision or automatable determination was provided in the input.

A low-privileged attacker who already holds valid EnterpriseOne credentials and can reach the JDENET server port crafts a sequence of malicious JDENET messages targeting the Advanced Pricing - Procurement component. Because the flaw is difficult to exploit (AC:H), the attacker must satisfy specific timing or state conditions, but a successful message sequence yields full compromise of the pricing component. No public POC is known, so this would require original exploit development.