JD Edwards EnterpriseOne CVE-2026-60618

Exploitation requires network access to the JD Edwards EnterpriseOne Procurement and Subcontract Management module over HTTP and valid low-privileged authentication to the application (CVSS PR:L), so this is not an anonymous, unauthenticated attack - the attacker must first possess or obtain a low-tier EnterpriseOne account. The affected configuration is specifically supported version 9.2 of the Procurement and Subcontract Management product; other versions are not named. Limiting factors that reduce realistic risk: the mandatory low-privilege authentication, and network reachability of the Procurement HTTP interface (an internally-segmented deployment shrinks the attack surface). No user interaction, no special non-default feature toggle, and low attack complexity are required once the attacker is authenticated, which is why Oracle rates it 'easily exploitable.'

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8 High) signals genuine risk: network reachable over HTTP, low attack complexity, no user interaction, and only low privileges required, yielding total impact on the affected module. Oracle's own language ('easily exploitable') reinforces the AC:L/PR:L reading. Counterbalancing this, no EPSS score was provided in the input, there is no POC or exploit code identified, and the CVE is not in CISA KEV - so there is no evidence of active or automated exploitation yet. The key limiting factor is PR:L: an attacker needs some valid (if low-tier) authenticated access to the EnterpriseOne environment, which narrows exposure to insiders or attackers who have already obtained credentials, rather than fully anonymous internet scanning. Net assessment: a real and high-priority issue for organizations running JD Edwards 9.2, driven by ease of exploitation and full-takeover impact, though the lack of KEV/POC/EPSS data means real-world exploitation likelihood is currently unquantified - treat as an urgent patch candidate, not a confirmed in-the-wild threat.

An attacker who holds or phishes a low-privileged JD Edwards EnterpriseOne user account sends crafted HTTP requests to the Procurement and Subcontract Management module, exploiting the flaw to escalate from that limited access to full control of the component. With no user interaction and low complexity, this yields takeover of procurement data and functionality - reading, altering, or disrupting purchase orders and subcontract records. No public POC is known, so an attacker would need to develop the exploit independently.