CVE-2026-60490 in JD Edwards EnterpriseOne CRM Foundation
Summary
by MITRE • 07/22/2026
Vulnerability in the JD Edwards EnterpriseOne CRM Foundation product of Oracle JD Edwards (component: CRM Foundation). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne CRM Foundation. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne CRM Foundation. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle JD Edwards EnterpriseOne CRM Foundation version 9.2, representing a critical security flaw that exposes the system to unauthorized access and potential compromise. The vulnerability operates at the application layer and specifically targets the CRM Foundation component of the enterprise resource planning suite, making it particularly dangerous for organizations relying on this platform for customer relationship management operations.
The technical nature of this vulnerability stems from insufficient authorization controls within the HTTP request processing mechanisms of the JD Edwards EnterpriseOne system. An attacker with low privileges can exploit this weakness through network-based HTTP connections to execute unauthorized actions that would normally require elevated permissions. This represents a privilege escalation flaw where the system fails to properly validate user credentials and access rights before executing sensitive operations.
The operational impact of this vulnerability is severe and multifaceted, encompassing complete system compromise as indicated by the CVSS 3.1 score of 8.8. The high base score reflects the combination of confidentiality, integrity, and availability impacts that can occur simultaneously. Successful exploitation could result in full system takeover where attackers gain administrative control over the CRM Foundation application, potentially leading to data breaches, system corruption, and complete disruption of customer relationship management operations.
From a cybersecurity perspective, this vulnerability aligns with CWE-284 (Improper Access Control) and represents a classic example of insufficient authorization checks in web applications. The CVSS vector analysis reveals that the attack requires minimal complexity (AC:L) and can be executed without user interaction (UI:N), making it particularly dangerous for organizations with exposed web services. This vulnerability falls under ATT&CK technique T1078 (Valid Accounts) as attackers can leverage compromised credentials to gain deeper system access.
Organizations should immediately implement network segmentation to limit exposure of the JD Edwards EnterpriseOne CRM Foundation to untrusted networks while applying Oracle's security patches and updates as soon as they become available. Additional mitigations include implementing robust web application firewalls, monitoring for suspicious HTTP requests, and conducting thorough access control reviews to ensure proper privilege separation. The vulnerability demonstrates the critical importance of maintaining up-to-date security patches and implementing defense-in-depth strategies to protect enterprise applications from exploitation.