What is the CVSS score of EUVD-2026-46874?

EUVD-2026-46874 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of JD Edwards EnterpriseOne are affected by EUVD-2026-46874?

Oracle JD Edwards EnterpriseOne Advanced Pricing-Procurement version 9.2 contains a network vulnerability (CVE-2026-60496) that allows authenticated users to achieve full system compromise and…

How to fix or mitigate EUVD-2026-46874?

Within 24 hours, identify and inventory all systems running JD Edwards EnterpriseOne Advanced Pricing-Procurement v9.2 and restrict network access to authorized personnel only; review access logs for suspicious JDENET protocol activity. Within 7 days, implement network segmentation and firewall rules to limit JDENET protocol access to only necessary systems and establish monitoring for abnormal traffic patterns on this protocol. Within 30 days, apply the Oracle Critical Patch Update (scheduled for July 2026) to remediate CVE-2026-60496 and verify successful patch deployment through functional testing.

JD Edwards EnterpriseOne EUVD-2026-46874

| CVE-2026-60496 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-07-21 secalert_us@oracle.com

GHSA-6m87-6g5f-cr9v

Authentication Bypass Oracle Jd Edwards Enterpriseone Advanced Pricing Procurement

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Network-reachable via JDENET (AV:N) but hard to exploit (AC:H) and requires valid low-privilege auth (PR:L); full takeover justifies C:H/I:H/A:H with no scope change (S:U).

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 04:19 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the JD Edwards EnterpriseOne Advanced Pricing - Procurement product of Oracle JD Edwards (component: Advanced Pricing). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Advanced Pricing - Procurement. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Advanced Pricing - Procurement. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full product takeover of Oracle JD Edwards EnterpriseOne Advanced Pricing - Procurement (version 9.2) is possible via the proprietary JDENET network protocol, where a low-privileged, network-authenticated attacker can compromise confidentiality, integrity, and availability. Oracle rates this CVSS 3.1 7.5, tempered by high attack complexity (AC:H), meaning exploitation is not straightforward. There is no public exploit identified at time of analysis and it is not on CISA KEV; the fix ships in the Oracle Critical Patch Update of July 2026.

Technical ContextAI

The affected component is the Advanced Pricing module within Oracle JD Edwards EnterpriseOne, an enterprise ERP suite. The attack surface is JDENET, JD Edwards' proprietary TCP-based network/inter-process communication protocol used by EnterpriseOne server components (enterprise server, JAS/HTML server, and kernel processes) to exchange messages. Because JDENET is the transport, exposure depends on whether these server ports are reachable by the attacker. Oracle did not assign a CWE (CWE: N/A), so the precise root-cause class (e.g., improper authorization, deserialization, or injection) cannot be stated from the available data; the 'takeover' outcome combined with C:H/I:H/A:H suggests a flaw permitting privileged actions or code execution within the pricing component rather than mere data leakage, despite the input's 'Information Disclosure' tag.

RemediationAI

Patch available per vendor advisory: apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) - Oracle CPUs are cumulative, so the JD Edwards 9.2 Tools/application patch bundle for this cycle is the primary and authoritative fix; an exact standalone fix version was not provided in the input, so consult the CPU patch matrix for the precise JD Edwards Tools release. As a compensating control until patching, restrict network reachability of the JDENET listener ports (the EnterpriseOne enterprise server ports) to trusted application tiers only via firewall/network segmentation, which prevents remote reach at the cost of breaking any legitimate cross-segment JDENET clients; additionally, tighten and audit low-privilege EnterpriseOne accounts (since PR:L is required) and monitor JDENET traffic for anomalous messages directed at the Advanced Pricing kernel. Do not expose EnterpriseOne server ports to the internet or to untrusted VLANs.