JD Edwards EnterpriseOne CVE-2026-60627

Exploitation requires network access to the JD Edwards EnterpriseOne Tools HTTP interface and a valid low-privileged authenticated account (CVSS PR:L) - it is not remote-unauthenticated. The specific attack surface is the Installation Security component reached via HTTP on version 9.2.26.3. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so the primary limiting factors are that the attacker must already authenticate at low privilege and must be able to reach the Tools HTTP endpoint; environments that isolate the Tools admin/HTTP tier behind network controls or that tightly govern low-tier account issuance materially raise the bar. The scope change (S:C) means a successful compromise can affect additional products beyond Tools itself.

Signals align toward high real-world priority rather than a high-score-only artifact: the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, score 9.9) describes a network-reachable, low-complexity attack needing only low privileges and no user interaction, with a scope change and full CIA impact - Oracle itself characterizes it as 'easily exploitable.' The main limiting factor is PR:L: the attacker must already hold some authenticated, low-privileged access to the ERP, which is realistic for insiders or via a compromised low-tier account but is not fully unauthenticated. No EPSS score, POC, or SSVC decision data was provided in the input, so exploitation probability and automatability cannot be quantified here; absence of a KEV listing means no confirmed active exploitation. Note one caveat: the vendor tags label this 'Information Disclosure,' yet the vector asserts full Integrity and Availability impact plus 'takeover' - the tag understates the described impact, so defenders should treat this as a takeover-class issue, not merely info disclosure.

An attacker who has obtained a low-privileged EnterpriseOne account - for example a rank-and-file ERP user credential from phishing or reuse - sends crafted HTTP requests to the Installation Security component of JD Edwards EnterpriseOne Tools 9.2.26.3. Exploitation requires no user interaction and has low attack complexity, letting the attacker escalate to full takeover of the Tools platform and, via the scope change, pivot into connected EnterpriseOne products and data. No public exploit code is identified at time of analysis, so this reflects the CVSS-described capability rather than an observed campaign.