What is the CVSS score of CVE-2026-60627?

CVE-2026-60627 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of JD Edwards EnterpriseOne are affected by CVE-2026-60627?

Oracle JD Edwards EnterpriseOne Tools 9.2.26.3 contains a critical remote takeover vulnerability that allows low-privileged network users to achieve complete system compromise.

How to fix or mitigate CVE-2026-60627?

Within 24 hours, isolate JD Edwards EnterpriseOne Tools 9.2.26.3 instances from untrusted networks and restrict HTTP access to only critical business users. Within 7 days, implement network segmentation to limit connectivity to JD Edwards systems, audit all low-privileged account access to affected instances, and configure alerting for suspicious Installation Security component access patterns. Within 30 days, monitor Oracle security updates for a patch to version 9.2.26.3 or later, perform full downstream impact assessment on connected systems, and develop a staged upgrade and remediation plan for all JD Edwards deployments.

JD Edwards EnterpriseOne CVE-2026-60627

EUVD-2026-46985 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 secalert_us@oracle.com

GHSA-g82v-g699-89m6

Oracle Authentication Bypass Jd Edwards Enterpriseone Tools

9.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Network HTTP reach, low complexity, and a low-privileged account (PR:L) with no user interaction, plus a scope change enabling full CIA takeover of Tools and adjacent products.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 07:20 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

CRITICAL 9.9

DescriptionCVE.org

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). The supported version that is affected is 9.2.26.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. While the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle JD Edwards EnterpriseOne Tools 9.2.26.3 is possible when a low-privileged attacker with HTTP network access exploits a flaw in the Installation Security component. Because the CVSS scope is changed (S:C), a successful attack does not stay contained to EnterpriseOne Tools but can significantly impact additional connected products, yielding full confidentiality, integrity, and availability loss (CVSS 9.9). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was disclosed in Oracle's July 2026 Critical Patch Update.

Technical ContextAI

JD Edwards EnterpriseOne Tools is the runtime, middleware, and administration layer (the 'Tools' foundation) underneath Oracle's JD Edwards EnterpriseOne ERP applications, handling deployment, security, and integration across the ERP stack. The affected area is the Installation Security component, reached over HTTP, which governs how the platform provisions and secures installed artifacts and trust between EnterpriseOne services. Oracle did not assign a CWE (CWE: N/A) and, per its Critical Patch Update convention, does not publish root-cause internals; the scope-change flag (S:C) indicates the vulnerable component can act on resources beyond its own security authority, so a compromise of the Tools security layer propagates to adjacent EnterpriseOne products and integrations. The single affected version is confirmed as 9.2.26.3.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html), which is the vendor-released remediation channel for this CVE; no discrete fixed version string is stated in the input beyond the CPU, so consult the CPU patch matrix for the exact JD Edwards EnterpriseOne Tools patch that supersedes 9.2.26.3. Because Oracle CPU patches are cumulative, prioritize scheduling this quarterly patch promptly given the 9.9 score and scope change. Pending patch deployment, reduce exposure by restricting HTTP access to EnterpriseOne Tools administration and Installation Security endpoints to trusted management networks and jump hosts only (trade-off: may disrupt remote admin workflows), tightening and auditing low-privilege ERP accounts since PR:L is the exploitation gate (trade-off: account-review effort and possible friction for legitimate users), and enabling monitoring/WAF logging on the Tools HTTP tier to detect anomalous requests. These are compensating controls only and do not substitute for the CPU patch.