JD Edwards EnterpriseOne CVE-2026-60621

Exploitation targets the Web Runtime Security component of JD Edwards EnterpriseOne Tools 9.2.26.3 and requires network HTTP reachability to the JD Edwards web runtime tier - so the primary limiting factor is exposure: an internet-facing or broadly reachable web tier is exploitable, while a segmented internal-only deployment is not. Per the CVSS vector (PR:N/UI:N) no authentication or user interaction is needed, but the AC:H rating means Oracle classifies this as 'difficult to exploit', implying the attacker must meet conditions outside their full control (e.g. win a timing/race window or defeat a mitigating check) rather than fire a single deterministic request. Oracle's advisory does not name a specific non-default configuration toggle, so the constraining factors are network exposure of the web tier and the high attack complexity itself, not a special feature flag.

The signals are mixed and warrant nuance rather than automatic top-priority treatment. The CVSS 3.1 score of 8.1 is high and the vector confirms remote, unauthenticated, no-user-interaction access (AV:N/PR:N/UI:N) with full C:H/I:H/A:H impact and unchanged scope - but AC:H materially lowers real-world likelihood, indicating the attacker must win a race condition, defeat a mitigation, or satisfy conditions not fully in their control. No EPSS score was provided, so exploitation probability cannot be quantified from this data. The flaw is not in CISA KEV and no public exploit was identified, so there is no evidence of active or automatable exploitation; SSVC-style reasoning would place this at 'exploitation: none' with 'technical impact: total' and automatability likely 'no' given AC:H. Net: a genuine severe-impact issue that should be patched in the normal Oracle CPU cycle, but absent KEV/POC/EPSS evidence it is not an emergency for most environments - prioritize by exposure of the JD Edwards web tier to untrusted networks.

An attacker with network reach to the JD Edwards EnterpriseOne web tier sends crafted HTTP requests to the Web Runtime Security component and, after satisfying the difficult exploitation conditions reflected by AC:H (such as a race or bypass), defeats runtime security controls to gain full control of the Tools layer without any credentials. Because the outcome is described as 'takeover', the attacker could then read, alter, or destroy ERP data and disrupt availability. No public proof-of-concept was identified at time of analysis, which currently raises the practical bar for opportunistic attackers.