What is the CVSS score of CVE-2026-60499?

CVE-2026-60499 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of JD Edwards EnterpriseOne are affected by CVE-2026-60499?

Oracle JD Edwards EnterpriseOne Solution Advisor 9.2 contains a critical vulnerability (CVSS 8.8) that allows low-privileged attackers to fully compromise the application over the network, risking…

How to fix or mitigate CVE-2026-60499?

Within 24 hours, immediately restrict network access to the Oracle JD Edwards EnterpriseOne Solution Advisor 9.2 component by disabling HTTP access or limiting it to authorized internal networks only, and conduct an emergency audit of user access and authentication logs for signs of compromise. Within 7 days, implement or strengthen multi-factor authentication for all Solution Advisor user accounts, conduct a full access review to eliminate unnecessary privileges, and if operationally feasible, disable the Solution Advisor component entirely pending patch availability. Within 30 days, monitor Oracle's Critical Patch Update releases and apply the fix to JD Edwards EnterpriseOne 9.2 immediately upon availability; coordinate with Oracle support regarding timeline and interim security measures.

JD Edwards EnterpriseOne CVE-2026-60499

EUVD-2026-46877 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-07-21 secalert_us@oracle.com

GHSA-89gm-9pqc-xwgv

Authentication Bypass Oracle Jd Edwards Enterpriseone Solution Advisor

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network HTTP reach with low complexity and no UI, but a valid low-privilege account is required (PR:L); full component takeover yields C:H/I:H/A:H with unchanged scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 04:20 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the JD Edwards EnterpriseOne Solution Advisor product of Oracle JD Edwards (component: Solution Advisor). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Solution Advisor. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Solution Advisor. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Account takeover in Oracle JD Edwards EnterpriseOne Solution Advisor 9.2 lets a low-privileged, network-authenticated attacker fully compromise the Solution Advisor component over HTTP. Oracle rates the flaw 8.8 (High) with full confidentiality, integrity, and availability impact and describes it as easily exploitable, meaning a foothold with minimal application privileges can escalate to complete takeover. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and network vector warrant prompt patching in the July 2026 Oracle Critical Patch Update.

Technical ContextAI

Solution Advisor is a web-delivered advisory/configuration module of Oracle's JD Edwards EnterpriseOne ERP suite, exposed over HTTP as part of the EnterpriseOne HTML/web tier (typically fronted by WebLogic/JAS). The vulnerability is reached across the network by an already-authenticated low-privilege user, indicating a flaw in the application's server-side request handling or access-control logic rather than in the underlying transport. Oracle does not publish a CWE for this issue (CWE: N/A) and applies its custom Information Disclosure tag, but the CVSS profile (C:H/I:H/A:H with 'takeover' language) points to a broken-access-control or injection-class defect that lets a low-privileged session act with far greater authority than intended. Exact affected code paths are not disclosed, consistent with Oracle CPU practice of withholding technical detail until patches propagate.

RemediationAI

Patch available per vendor advisory: apply the fixes delivered in the Oracle July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html) to JD Edwards EnterpriseOne Solution Advisor 9.2; Oracle does not enumerate a discrete fix build number in the supplied data, so identify the exact tools-release/ESU from the CPU advisory before deployment. Because exploitation requires an authenticated low-privilege session, interim compensating controls are meaningful: restrict network reachability of the Solution Advisor / EnterpriseOne web tier to trusted internal segments or VPN via firewall or WebLogic access rules (trade-off: may block legitimate remote users), tighten role assignments so only necessary accounts can reach the Solution Advisor module (trade-off: administrative overhead and possible workflow disruption), and increase monitoring of low-privilege account activity and web-tier logs for anomalous privilege use. These controls reduce exposure but do not remove the flaw, so treat them as bridges to the CPU patch, not substitutes.