What is the CVSS score of CVE-2026-60498?

CVE-2026-60498 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of JD Edwards EnterpriseOne are affected by CVE-2026-60498?

Oracle JD Edwards EnterpriseOne Human Resources Management 9.2 is vulnerable to complete compromise of the HR module through an authenticated network attack with high complexity requirements.

How to fix or mitigate CVE-2026-60498?

Within 24 hours: Inventory all JDENET service access points and restrict network exposure to authorized systems only; implement IP-based access controls and conduct an immediate audit of active HR module user sessions. Within 7 days: Enable multi-factor authentication for all HR module accounts and configure enhanced logging on JDENET authentication attempts. Within 30 days: No vendor-released patch identified at time of analysis; contact Oracle for interim guidance and mitigation options; prioritize upgrade planning for Oracle JD Edwards EnterpriseOne or evaluate system transition timeline.

JD Edwards EnterpriseOne CVE-2026-60498

EUVD-2026-46876 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-07-21 secalert_us@oracle.com

GHSA-5pqq-53q8-wr27

Authentication Bypass Oracle Jd Edwards Enterpriseone Human Resources Management

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Network-reachable via JDENET (AV:N) but Oracle-rated difficult (AC:H) and requires a low-privileged account (PR:L); full takeover yields C:H/I:H/A:H with unchanged scope.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 04:19 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the JD Edwards EnterpriseOne Human Resources Management product of Oracle JD Edwards (component: Human Resources). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Human Resources Management. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Human Resources Management. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle JD Edwards EnterpriseOne Human Resources Management 9.2 is possible when a low-privileged attacker with network access to the JDENET service chains a hard-to-exploit flaw in the Human Resources component. Successful exploitation yields high confidentiality, integrity, and availability impact (complete compromise of the HR module). No public exploit has been identified at time of analysis and it is not listed in CISA KEV; risk is tempered by high attack complexity (AC:H) and a required authenticated foothold (PR:L).

Technical ContextAI

The affected technology is Oracle's JD Edwards EnterpriseOne ERP suite, specifically the Human Resources Management application running version 9.2, reachable through JDENET - the proprietary TCP-based network messaging/kernel communication protocol that EnterpriseOne servers use to exchange requests between enterprise servers, web/HTML servers, and clients. The vulnerability is reached over this JDENET channel rather than through the standard HTTP web tier. Oracle did not assign a CWE (CWE: N/A) and its advisory (the July 2026 Critical Patch Update) does not disclose the root-cause class; the 'Information Disclosure' tag combined with the CVSS Confidentiality/Integrity/Availability triad and the 'takeover' language indicates the flaw goes well beyond simple data exposure to a full component compromise. Because Oracle CPU entries are deliberately terse, the exact defective mechanism (e.g., deserialization, injection, access-control bypass in a JDENET kernel handler) is not publicly documented.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html) to JD Edwards EnterpriseOne Human Resources Management 9.2; Oracle ships this remediation as CPU tools/patch bundles rather than a single tagged product version, so the patch status is 'Patch available per vendor advisory' - the exact patched build number is not enumerated in the provided data and should be confirmed against the CPU patch matrix and My Oracle Support. Because exploitation traverses JDENET, the most effective compensating control until patching is to restrict network reachability of the JDENET enterprise-server ports to only trusted application/web servers and administrative subnets via firewall or segmentation (trade-off: misconfigured allow-lists can break legitimate kernel/web-server communication, so validate against your deployment topology). Additionally, tighten and review low-privilege EnterpriseOne accounts (PR:L is required), enforce least privilege and strong authentication on HR module roles, and enable JDENET/kernel logging to detect anomalous requests. There is no vendor-published standalone workaround that removes the flaw, so patching remains the primary fix; network isolation is a mitigation, not a substitute.