What is the CVSS score of CVE-2026-60619?

CVE-2026-60619 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Jd Edwards Enterpriseone Hcm Foundation are affected by CVE-2026-60619?

Oracle JD Edwards EnterpriseOne HCM Foundation 9.2 contains a HIGH-severity vulnerability enabling authenticated low-privileged users to achieve complete system compromise, affecting personnel,…

How to fix or mitigate CVE-2026-60619?

Within 24 hours, enumerate all low-privileged user accounts with access to affected JD Edwards HCM Foundation 9.2 systems and review access logs for the past 90 days for anomalous activity. Within 7 days, implement network segmentation restricting HCM access to essential personnel only, enable enhanced alerting on administrative functions, and contact Oracle to confirm patch release timelines and request emergency mitigation guidance. Within 30 days, apply the vendor patch immediately upon release and conduct a comprehensive review of HCM user access controls and low-privilege account governance.

Jd Edwards Enterpriseone Hcm Foundation CVE-2026-60619

EUVD-2026-46977 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-23c3-jxrw-cjhv

Privilege Escalation Oracle Jd Edwards Enterpriseone Hcm Foundation

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (oracle) · only source for this CVE.

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 07:22 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the JD Edwards EnterpriseOne HCM Foundation product of Oracle JD Edwards (component: Time Accounting and HRM Base). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne HCM Foundation. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne HCM Foundation. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full application takeover in Oracle JD Edwards EnterpriseOne HCM Foundation 9.2 (Time Accounting and HRM Base component) allows an authenticated, low-privileged attacker to compromise the product over HTTP. Per the CVSS vector (PR:L), a valid low-privilege account is required and exploitation is difficult (AC:H), but success yields high confidentiality, integrity, and availability impact — effectively total compromise of the HCM Foundation instance. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was disclosed in the Oracle July 2026 Critical Patch Update.