What is the CVSS score of CVE-2026-60497?

CVE-2026-60497 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of JD Edwards EnterpriseOne are affected by CVE-2026-60497?

Oracle JD Edwards EnterpriseOne CRM Foundation 9.2 is vulnerable to complete system compromise by attackers with low-level network access through the JDENET protocol, giving attackers full control…

How to fix or mitigate CVE-2026-60497?

Within 24 hours, identify all systems running Oracle JD Edwards EnterpriseOne CRM Foundation version 9.2 and assess network exposure of JDENET protocol access; enable enhanced logging and alerts for JDENET traffic and low-privilege account activities. Within 7 days, implement network segmentation to restrict JDENET protocol access to authorized administrative networks only, enforce principle of least privilege on all low-privileged accounts, and document current mitigation status. Within 30 days, monitor Oracle Security Alerts for patch availability targeting version 9.2 or upgrade guidance, establish a test environment to validate patches once released, and develop and execute a patch deployment plan.

JD Edwards EnterpriseOne CVE-2026-60497

EUVD-2026-46875 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-07-21 secalert_us@oracle.com

GHSA-6q27-q36g-q9gf

Authentication Bypass Oracle Jd Edwards Enterpriseone Crm Foundation

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Network-reachable JDENET (AV:N) but Oracle-confirmed high-complexity conditions (AC:H) and a required low-privileged account (PR:L); full component takeover gives C:H/I:H/A:H with unchanged scope.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 04:19 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the JD Edwards EnterpriseOne CRM Foundation product of Oracle JD Edwards (component: CRM Foundation). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne CRM Foundation. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne CRM Foundation. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle JD Edwards EnterpriseOne CRM Foundation 9.2 is possible when a low-privileged attacker with network access abuses the proprietary JDENET communication protocol, per Oracle's July 2026 Critical Patch Update. Successful exploitation yields complete takeover of the CRM Foundation component with high confidentiality, integrity, and availability impact, though Oracle rates the attack complexity as high. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

JD Edwards EnterpriseOne is Oracle's integrated ERP suite; the CRM Foundation is the shared services component underpinning its customer relationship management modules. The attack surface here is JDENET, the proprietary TCP-based inter-process messaging/network protocol that EnterpriseOne servers and clients use to exchange kernel requests and application traffic. Because exploitation traverses JDENET rather than the HTTP tier, the exposed listener (kernel/network processes on the enterprise/logic server) is the relevant entry point. Oracle did not assign a CWE (CWE: N/A), so the precise root-cause class (e.g., deserialization, authorization bypass, or memory corruption) cannot be confirmed from the available data; the 'takeover' language and high CIA impact are consistent with an authorization or injection flaw reachable by an authenticated JDENET participant.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html), which is the primary and vendor-authoritative remediation; the input provides no discrete fix version string beyond the CPU bundle, so track the specific JD Edwards EnterpriseOne CRM Foundation 9.2 patch listed in that CPU. Because exploitation occurs over JDENET, the most effective compensating control until patching is to restrict network reachability of the JDENET listener - firewall or ACL the enterprise/logic server ports so only trusted application tiers, presentation servers, and administrative hosts can connect, rather than exposing them to general user VLANs or the internet; the trade-off is that overly tight rules can break legitimate kernel-to-kernel or client traffic and must be validated against your deployment topology. Additionally, tighten account provisioning and monitor for anomalous JDENET connections, since the flaw requires only low privileges (PR:L) and an existing low-level account materially lowers the barrier.