What is the CVSS score of EUVD-2026-46986?

EUVD-2026-46986 has a CVSS 3.1 base score of 3.7 (Low). CVSS vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

JD Edwards EnterpriseOne EUVD-2026-46986

| CVE-2026-60628 LOW

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-w4vj-5g48-4fjr

Oracle Authentication Bypass Jd Edwards Enterpriseone Tools

3.7

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

3.7 LOW

AV:A/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

vuln.today AI

3.7 LOW

AV:A matches the physical-segment access requirement; AC:H reflects vendor-stated difficult exploitation; C:L/I:L bound the partial data impact with no availability effect.

3.1 AV:A/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

4.0 AV:A/AC:H/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 09:00 vuln.today

DescriptionCVE.org

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). The supported version that is affected is 9.2.26.3. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data as well as unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 3.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N).

AnalysisAI

Authentication bypass in Oracle JD Edwards EnterpriseOne Tools 9.2.26.3 (Installation Security component) permits an unauthenticated attacker on the same physical network segment to partially read and modify data accessible to the application. Exploitation is constrained by high attack complexity and a mandatory user-interaction requirement, making opportunistic attacks highly impractical. No public exploit code exists and the vulnerability is not listed in CISA KEV; CVSS 3.7 (Low) accurately reflects the limited real-world threat.

Technical ContextAI

JD Edwards EnterpriseOne Tools is Oracle's ERP platform toolset; the affected component is Installation Security, which governs authentication and access controls during installation and maintenance operations. The attack vector (AV:A) specifies that the attacker must be co-located on the same physical communication segment - such as the same LAN, VLAN, or segment of the network fabric hosting the EnterpriseOne server hardware - ruling out internet-originated attacks entirely. The 'Authentication Bypass' tag points to a root cause consistent with CWE-287 (Improper Authentication) or CWE-306 (Missing Authentication for Critical Function), though no CWE was formally assigned in the provided data. The scope is unchanged (S:U), and impacts are bounded to partial confidentiality (C:L) and partial integrity (C:L) - limited unauthorized data read and write - with no availability impact (A:N). No CPE string was included in the intelligence data; the single confirmed affected release is 9.2.26.3.

RemediationAI

Apply Oracle's July 2026 Critical Patch Update, which addresses this vulnerability in the Installation Security component of JD Edwards EnterpriseOne Tools; the advisory is available at https://www.oracle.com/security-alerts/cpujul2026.html. An exact patched release number beyond the CPU designation was not independently confirmed from the available references - consult the advisory directly for the target patch-set version. As a compensating control prior to patching, restrict network access to the physical and logical segment hosting EnterpriseOne installation infrastructure to explicitly trusted hosts and personnel only, directly neutralizing the AV:A attack vector; note that this requires network-layer enforcement (ACLs, VLAN isolation) and does not substitute for patching. Additionally, limit who can initiate installation or maintenance sessions on the EnterpriseOne host, since user interaction is a prerequisite for successful exploitation - reducing the pool of interactive users during installation activities lowers the UI:R opportunity window.