CVE-2026-60495 in JD Edwards EnterpriseOne Requirements Planning
Summary
by MITRE • 07/22/2026
Vulnerability in the JD Edwards EnterpriseOne Requirements Planning product of Oracle JD Edwards (component: Requirements Planning). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Requirements Planning. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Requirements Planning. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle JD Edwards EnterpriseOne Requirements Planning component version 9.2, representing a significant security weakness that can be exploited by low-privileged attackers with network access through the JDENET protocol. The CVSS base score of 7.5 indicates a high-severity issue affecting confidentiality, integrity, and availability aspects of the system. The attack vector is network-based with high complexity requirements and only low privileges needed for exploitation, making this vulnerability particularly concerning for organizations relying on this enterprise resource planning solution.
The technical flaw manifests as a remote code execution vulnerability that allows attackers to gain full control over the affected JD Edwards EnterpriseOne Requirements Planning instance. This type of vulnerability typically stems from inadequate input validation or improper access controls within the JDENET communication layer, which serves as the primary network interface for EnterpriseOne applications. The low privilege requirement suggests that the vulnerability may involve authentication bypass mechanisms or insufficient authorization checks during network protocol handling. Such weaknesses can originate from design flaws classified under CWE-284 (Improper Access Control) or CWE-352 (Cross-Site Request Forgery) categories, depending on the specific implementation details.
The operational impact of this vulnerability extends beyond simple data compromise to encompass complete system takeover capabilities that can disrupt business operations and expose sensitive corporate information. Organizations utilizing JD Edwards EnterpriseOne Requirements Planning face potential exposure to data theft, system manipulation, and service disruption that could affect supply chain planning processes and inventory management systems. The confidentiality impact is particularly severe as attackers could access proprietary business data including customer information, pricing structures, and operational plans. Integrity compromise allows for unauthorized modification of planning data which could lead to significant financial losses and operational inefficiencies. Availability impacts threaten the core functionality of the enterprise planning system, potentially causing production delays and supply chain disruptions that affect entire organizations.
Mitigation strategies should prioritize immediate patch application from Oracle as the primary defense mechanism, given that this vulnerability affects a supported version with known remediation paths available through official security patches. Network segmentation and firewall rule implementation can help reduce attack surface by restricting JDENET access to only authorized systems and users. Additional protective measures include implementing network monitoring solutions to detect anomalous JDENET traffic patterns, establishing robust authentication mechanisms, and conducting regular vulnerability assessments targeting the affected component. Security teams should also consider implementing the principle of least privilege for all JD Edwards EnterpriseOne system access, ensuring that users have only necessary permissions to perform their business functions. Organizations may need to review their incident response procedures to ensure rapid detection and containment of potential exploitation attempts, as this vulnerability could enable attackers to establish persistent access to critical enterprise planning systems.
The attack surface for this vulnerability aligns with ATT&CK tactics including TA0001 (Initial Access) through network-based exploitation and TA0003 (Persistence) if attackers successfully maintain access post-exploitation. Defense in depth strategies should include application whitelisting, intrusion detection system deployment, and regular security awareness training for personnel who might interact with the affected systems. Organizations should also consider implementing privileged access management solutions to further reduce risk exposure from potential exploitation of this vulnerability type.