CVE-2026-60618

HighCVSS 8.8

Published: 21/07/2026(UTC)Updated: 05/08/2026(UTC)Translated: 24/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.39%

32th percentile - higher than 32% of all known CVEs

Summary

Vulnerability in JD Edwards EnterpriseOne Procurement and Subcontract Management (Procurement component) version 9.2. Low-privileged attacker via HTTP can take over the system.

Risk Assessment

Risk of full takeover of JD Edwards EnterpriseOne, leading to procurement process disruption and data leakage.

Recommendation

Apply Oracle patch for version 9.2. Restrict network access.

Other vulnerabilities in JD Edwards EnterpriseOne

CVE-2026-60494High
Vulnerability in the JD Edwards EnterpriseOne General Ledger product of Oracle JD Edwards (component: E1 Foundation). Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne General Ledger.

Original NVD description (English source)

Vulnerability in the JD Edwards EnterpriseOne Procurement and Subcontract Management product of Oracle JD Edwards (component: Procurement). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Procurement and Subcontract Management. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Procurement and Subcontract Management. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).