CVE-2026-60497 in JD Edwards EnterpriseOne
Summary
by MITRE • 07/22/2026
Vulnerability in the JD Edwards EnterpriseOne CRM Foundation product of Oracle JD Edwards (component: CRM Foundation). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne CRM Foundation. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne CRM Foundation. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/23/2026
This vulnerability exists within Oracle JD Edwards EnterpriseOne CRM Foundation version 9.2, representing a significant security weakness that can be exploited by low-privileged attackers with network access through the JDENET protocol. The CVSS base score of 7.5 indicates a high-severity threat with impacts across all three core security principles including confidentiality, integrity, and availability. The vulnerability's difficulty level suggests it requires some technical expertise but is not overly complex to execute, making it particularly concerning for organizations relying on this enterprise resource planning system.
The technical flaw manifests as a remote code execution vulnerability that allows attackers to gain complete control over the affected JD Edwards EnterpriseOne CRM Foundation instance. This type of vulnerability typically stems from inadequate input validation or improper access controls within the JDENET communication layer, which serves as the primary network interface for enterpriseone applications. The low privilege requirement means that even users with minimal system permissions could potentially exploit this weakness to achieve full system compromise.
The operational impact of successfully exploiting this vulnerability is severe and multifaceted. An attacker who gains control over the CRM Foundation system could access sensitive customer data, manipulate business processes, disrupt operations, and potentially use the compromised system as a pivot point for attacking other connected systems within the enterprise network. This represents a critical failure in the principle of least privilege and could lead to significant financial losses, regulatory violations, and reputational damage for organizations using this software.
Organizations should implement immediate mitigations including applying Oracle's security patches and updates, implementing network segmentation to limit access to JDENET ports, enforcing strict firewall rules, and monitoring for suspicious network activity. The vulnerability aligns with CWE-20 (Improper Input Validation) and may map to ATT&CK techniques involving remote code execution and privilege escalation. Regular security assessments and penetration testing should be conducted to identify similar weaknesses in the broader enterprise infrastructure, as this vulnerability demonstrates the critical importance of maintaining up-to-date security controls for enterprise applications.