What is the CVSS score of CVE-2026-60621?

CVE-2026-60621 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of JD Edwards EnterpriseOne are affected by CVE-2026-60621?

A critical vulnerability in Oracle JD Edwards EnterpriseOne Tools 9.2.26.3 enables unauthenticated remote attackers to achieve full system takeover, with no public exploit identified at time of…

How to fix or mitigate CVE-2026-60621?

Within 24 hours, inventory all systems running JD Edwards EnterpriseOne Tools 9.2.26.3 and segment the Web Runtime Security component from untrusted networks; implement firewall rules restricting HTTP access to authorized administrator IP ranges only. Within 7 days, establish continuous monitoring for Oracle security advisories and eventual patch availability; assess whether affected systems can operate in isolated or air-gapped configurations. Within 30 days, prepare for rapid patch deployment once available, and implement a sustained compensating control strategy with regular security audits and network-layer protections.

JD Edwards EnterpriseOne CVE-2026-60621

EUVD-2026-46979 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-07-21 secalert_us@oracle.com

GHSA-xr99-79r8-rjm6

Oracle Authentication Bypass Jd Edwards Enterpriseone Tools

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Remote HTTP and unauthenticated (AV:N/PR:N) per Oracle, but 'difficult to exploit' sets AC:H, and full takeover yields C:H/I:H/A:H with unchanged scope.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 07:22 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime Security). The supported version that is affected is 9.2.26.3. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full system takeover in Oracle JD Edwards EnterpriseOne Tools 9.2.26.3 is possible when an unauthenticated remote attacker reaches the Web Runtime Security component over HTTP, per Oracle's July 2026 Critical Patch Update. Despite requiring no credentials, the attack is rated hard to execute (CVSS 3.1 8.1, AC:H), and success yields complete confidentiality, integrity, and availability compromise of the Tools layer. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.

Technical ContextAI

JD Edwards EnterpriseOne Tools is the technology foundation (web/runtime, security, and middleware layer) beneath Oracle's JD Edwards EnterpriseOne ERP applications, typically deployed as a Java-based web tier fronting HTTP clients. The affected 'Web Runtime Security' component governs session, authentication, and request-processing security for the web runtime, so a defect here directly exposes the trust boundary that gates access to ERP functionality. Oracle did not assign a CWE (CWE: N/A) and, consistent with its Critical Patch Update disclosure practice, withheld root-cause and vector-specific detail; the 'Information Disclosure' tag combined with the full C/I/A impact profile suggests a security-control bypass in request handling rather than a pure read-only leak, but the exact weakness class is not stated in the available data.

RemediationAI

Apply the fix from Oracle's July 2026 Critical Patch Update (Patch available per vendor advisory: https://www.oracle.com/security-alerts/cpujul2026.html) - Oracle does not publish a standalone fixed Tools version number in the supplied data, so obtain the specific patched Tools release from that advisory and your My Oracle Support account. Until patched, reduce exposure of the JD Edwards EnterpriseOne web runtime: restrict HTTP access to the Tools web tier to trusted internal networks or VPN, place it behind a WAF/reverse proxy that can filter anomalous requests to the web runtime, and enforce network segmentation so the ERP web layer is not reachable from the public internet - the trade-off is that legitimate remote or partner access may require VPN onboarding or allowlist maintenance. Monitor JD Edwards web tier logs for anomalous unauthenticated request patterns as a detective control while scheduling the patch.