CVE-2026-60493
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
Vulnerability in JD Edwards EnterpriseOne Human Resources Management (Human Resources component) allows a low-privileged attacker to take over the system over the network via HTTP. Version 9.2 is affected.
Risk Assessment
A successful attack can lead to full takeover of JD Edwards EnterpriseOne Human Resources Management, risking data confidentiality, integrity, and availability.
Recommendation
Apply the Oracle patch for version 9.2 immediately. Restrict HTTP access to trusted networks.
Other vulnerabilities in JD Edwards EnterpriseOne Human Resources Management
See all- CVE-2026-87389Low
Vulnerability in Oracle JD Edwards EnterpriseOne Human Resources Management (component: Human Resources) affecting version 9.2. A difficult-to-exploit flaw allows an unauthenticated attacker with network access via HTTP to gain unauthorized update, insert, or delete access to some data. CVSS 3.1 Base Score 3.7.
- CVE-2026-87385Medium
Vulnerability in JD Edwards EnterpriseOne Human Resources Management (Human Resources component) affecting version 9.2. An unauthenticated attacker with JDENET network access can, under difficult conditions, gain unauthorized update, insert or delete access to data and read access to a subset of data.
- CVE-2026-87384Medium
Vulnerability in the Human Resources component of Oracle JD Edwards EnterpriseOne Human Resources Management version 9.2. A low-privileged attacker with network access via JDENET can perform unauthorized updates, inserts or deletes and cause a partial denial of service.
- CVE-2026-60498High
Vulnerability in JD Edwards EnterpriseOne Human Resources Management (version 9.2) in Human Resources component. Difficult to exploit, low-privileged attacker via JDENET can take over the system.
Original NVD description (English source)
Vulnerability in the JD Edwards EnterpriseOne Human Resources Management product of Oracle JD Edwards (component: Human Resources). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Human Resources Management. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Human Resources Management. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS