What is the CVSS score of CVE-2026-60618?

CVE-2026-60618 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of JD Edwards EnterpriseOne are affected by CVE-2026-60618?

Oracle JD Edwards EnterpriseOne Procurement and Subcontract Management v9.2 can be completely compromised by a low-privileged attacker, exposing organizations to supply chain disruption, financial…

How to fix or mitigate CVE-2026-60618?

Within 24 hours: Conduct an inventory of all JD Edwards EnterpriseOne 9.2 instances running Procurement and Subcontract Management modules; immediately implement network access restrictions limiting connectivity to the Procurement module to essential business roles only. Within 7 days: Deploy enhanced audit logging and transaction monitoring for all Procurement module activities; enforce account lockout policies for failed authentication attempts; enable session timeout restrictions where available. Within 30 days: Monitor Oracle's security advisories for Critical Patch Update release addressing CVE-2026-60618; upon patch availability, prioritize deployment to all affected 9.2 instances, and assess whether architectural changes (such as upgrading to a patched JD Edwards version or implementing procurement function isolation) are feasible.

JD Edwards EnterpriseOne CVE-2026-60618

EUVD-2026-46976 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-07-21 secalert_us@oracle.com

GHSA-8565-m6rx-c7jv

Authentication Bypass Oracle Jd Edwards Enterpriseone Procurement And Subcontract Management

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Oracle describes easy HTTP exploitation by a low-privileged user (AV:N/AC:L/PR:L/UI:N) resulting in full module takeover, so C/I/A all High with unchanged scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 07:22 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the JD Edwards EnterpriseOne Procurement and Subcontract Management product of Oracle JD Edwards (component: Procurement). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Procurement and Subcontract Management. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Procurement and Subcontract Management. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle JD Edwards EnterpriseOne Procurement and Subcontract Management (version 9.2) is achievable by a low-privileged attacker with HTTP network access, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 score of 8.8 and Oracle explicitly characterizes it as 'easily exploitable,' with successful attacks resulting in complete takeover of the Procurement component (confidentiality, integrity, and availability all high). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the authenticated-yet-low-barrier profile makes it a strong patch priority for JD Edwards operators.

Technical ContextAI

The affected software is Oracle JD Edwards EnterpriseOne, an integrated ERP suite; specifically its Procurement and Subcontract Management module (Oracle-listed component: Procurement) at supported version 9.2. EnterpriseOne is a multi-tier Java/web-based enterprise application typically fronted by HTML/web servers and application servers communicating over HTTP, which aligns with the AV:N/HTTP attack surface. Oracle did not assign a CWE (CWE: N/A) and does not disclose the root cause class in its Critical Patch Update advisory; the vendor tag 'Information Disclosure' hints at a data-exposure dimension, but the full C:H/I:H/A:H impact indicates the weakness goes beyond disclosure to enable complete module takeover. Without a published CWE or technical write-up, the precise defect (e.g., injection, access-control, or deserialization flaw) cannot be confirmed from available data.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html), which is the vendor's remediation channel for this CVE; Patch available per vendor advisory, though the input does not specify an exact patched build number, so consult the CPU matrix for the precise JD Edwards 9.2 tools/application release to apply. Because exploitation requires only low privileges over HTTP, until patching completes reduce exposure by restricting network access to the EnterpriseOne Procurement web/application tier to trusted management networks or VPN, tightening and auditing low-tier user accounts and their entitlements to the Procurement module (accepting that over-restriction may impede legitimate procurement users), and increasing monitoring of HTTP requests to the affected endpoints. These are compensating controls only and do not substitute for installing the Oracle CPU update.