What is the CVSS score of CVE-2026-60626?

CVE-2026-60626 has a CVSS 3.1 base score of 6.0 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N. EPSS exploitation probability: 0.1%.

JD Edwards EnterpriseOne CVE-2026-60626

EUVD-2026-46984 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-58wc-rhpq-46c6

Oracle Authentication Bypass Jd Edwards Enterpriseone Tools

6.0

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.0 MEDIUM

AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N

vuln.today AI

6.0 MEDIUM

Local vector confirmed by description; PR:H aligns with 'high privileged attacker with logon'; scope change and integrity-only impact match unauthorized data modification across dependent products.

3.1 AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N

4.0 AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 09:00 vuln.today

DescriptionCVE.org

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). The supported version that is affected is 9.2.26.3. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools. While the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 6.0 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N).

AnalysisAI

Integrity compromise in JD Edwards EnterpriseOne Tools 9.2.26.3 allows a high-privileged local attacker to perform unauthorized creation, deletion, or modification of critical data - including all data accessible to the EnterpriseOne Tools platform - with a scope change that may extend impact to additional dependent products. The vulnerability resides in the Installation Security component and is tagged as an Authentication Bypass, suggesting the high-privilege requirement may be circumvented or bypassed under specific conditions. No public exploit code and no CISA KEV listing have been identified at time of analysis; this is a July 2026 Oracle Critical Patch Update disclosure.

Technical ContextAI

JD Edwards EnterpriseOne Tools is the foundational runtime and deployment infrastructure for Oracle's JD Edwards ERP suite, version 9.2.26.3 being the specific affected release. The vulnerable component is 'Installation Security', the subsystem responsible for governing access controls and permission enforcement during tool installation and configuration operations. The Authentication Bypass tag (despite PR:H in CVSS) suggests the flaw may allow a privileged local operator to bypass security checks within this component - potentially escalating effective access beyond their granted role or acting outside normal authorization boundaries. The CVSS scope change (S:C) confirms that exploitation within the EnterpriseOne Tools layer can propagate integrity violations to other JD Edwards modules or integrated business processes. No CWE has been assigned, which limits precise root-cause classification, but Authentication Bypass combined with an integrity-only impact profile is consistent with weaknesses such as CWE-287 (Improper Authentication) or CWE-863 (Incorrect Authorization) in installation-time security logic.

RemediationAI

Apply Oracle's July 2026 Critical Patch Update (CPU), which addresses this vulnerability per the advisory at https://www.oracle.com/security-alerts/cpujul2026.html. An exact patched version number beyond 9.2.26.3 is not independently confirmed in the available data - consult Oracle's patch matrix in the CPU advisory for the precise fix version. As a compensating control prior to patching, restrict local logon access to JD Edwards EnterpriseOne Tools infrastructure hosts to the minimum set of privileged accounts necessary (principle of least privilege), as AV:L means exploitation requires a local foothold. Additionally, audit and harden the Installation Security component's permissions - disabling or tightly restricting installation-mode operations when not actively performing upgrades or deployments reduces the attack surface without impacting normal ERP runtime operations. Monitor integrity of JD Edwards configuration and security data for unauthorized modifications as a detective control.