EUVD-2026-46867
GHSA-cpg5-cfwp-c3r6
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Authenticated low-privilege user (PR:L) reaches CRM Foundation over HTTP (AV:N) with low complexity and no interaction, achieving full component takeover (C:H/I:H/A:H).
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the JD Edwards EnterpriseOne CRM Foundation product of Oracle JD Edwards (component: CRM Foundation). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne CRM Foundation. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne CRM Foundation. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
AnalysisAI
Full product takeover in Oracle JD Edwards EnterpriseOne CRM Foundation 9.2 lets an authenticated low-privileged attacker with HTTP network access compromise the CRM Foundation component and gain complete control over its confidentiality, integrity, and availability. Rated CVSS 3.1 8.8, the flaw is described by Oracle as easily exploitable and resolved in the July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Technical ContextAI
JD Edwards EnterpriseOne is Oracle's integrated ERP suite; the affected CRM Foundation component underpins customer relationship management functions and is reached over HTTP through the EnterpriseOne web/HTML server tier. Because the CVSS vector is AV:N/PR:L, the attack surface is an authenticated web-facing application function rather than a low-level protocol. No CWE was assigned (CWE: N/A) and Oracle's CPU advisory does not disclose the root-cause class; the vendor tag 'Information Disclosure' is present, but the C:H/I:H/A:H impact profile and the explicit 'takeover' language indicate the flaw goes well beyond mere data exposure into full component compromise. Exact affected build is EnterpriseOne CRM Foundation 9.2; no CPE strings were provided in the source data.
RemediationAI
Apply the fixes delivered in the Oracle July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html); Oracle addresses CVE-2026-60489 as part of that CPU, but the input does not specify an exact patched build number, so consult the CPU patch matrix for the precise JD Edwards tools/application release for version 9.2 and schedule it on your next maintenance window. Because exploitation requires low-privileged authenticated access, interim compensating controls until patching include tightening EnterpriseOne CRM Foundation role and menu security to remove unnecessary user access to the affected functionality, restricting network reachability of the EnterpriseOne HTML/web server tier to trusted internal networks or VPN, and enabling web-tier logging/WAF monitoring for anomalous authenticated requests - with the trade-off that access restrictions may disrupt legitimate remote CRM users and role tightening requires careful testing to avoid breaking business workflows. No vendor-released patched version was independently confirmed from the provided data beyond the CPU reference.
Full compromise of Oracle JD Edwards EnterpriseOne CRM Foundation 9.2 is possible by a low-privileged, network-based att
Full compromise of Oracle JD Edwards EnterpriseOne CRM Foundation 9.2 is possible when a low-privileged attacker with ne
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today