JD Edwards EnterpriseOne CVE-2026-60499

Exploitation requires a valid low-privileged authenticated account on JD Edwards EnterpriseOne Solution Advisor 9.2 (CVSS PR:L) and network HTTP access to the Solution Advisor web component; no user interaction and no elevated privileges are needed (UI:N, AC:L). The limiting factors defenders can lean on are the authentication requirement (an unauthenticated outsider cannot exploit this directly) and network exposure of the Solution Advisor tier - systems where the module is reachable only from a restricted internal network or where low-privilege accounts are tightly controlled present a materially smaller attack surface. Only version 9.2 is stated to be affected.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8 High) is internally consistent: network-reachable, low complexity, no user interaction, and only low privileges required, yielding full CIA loss and 'takeover.' The single meaningful barrier is PR:L - the attacker must already hold a valid low-privilege EnterpriseOne account, so this is realistically an insider or post-compromise escalation rather than pure external drive-by. No EPSS score, POC, or KEV entry is present in the supplied data, so exploitation probability cannot be quantified and there is no evidence of active exploitation; the risk rests on the vector plus Oracle's 'easily exploitable' characterization. ERP systems hold financials and PII, so business impact of a takeover is high even if exploitation likelihood is presently unproven. Note the mild tension between Oracle's 'Information Disclosure' tag and the full I:H/A:H (write/availability) impact - treat the tag as a coarse label and rely on the vector, which clearly indicates more than read-only disclosure.

An attacker who has obtained or been granted a low-privilege EnterpriseOne account (for example a contractor, disgruntled employee, or an adversary reusing phished credentials) sends crafted HTTP requests to the Solution Advisor endpoint and abuses the flaw to escalate to full control of the component. With takeover achieved, they can read, alter, or destroy the ERP data and configuration the module governs. No public POC is present in the supplied intelligence, but the low attack complexity means weaponization would be straightforward once technical detail emerges.