CVE-2026-60627
CriticalCVSS 9.9Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
Vulnerability in Oracle JD Edwards EnterpriseOne Tools (component: Installation Security). Affected version is 9.2.26.3. A low-privileged attacker with network access via HTTP can compromise the tools, potentially impacting other products.
Risk Assessment
Risk of takeover of JD Edwards EnterpriseOne Tools, leading to compromise of confidentiality, integrity, and availability, and affecting other systems.
Recommendation
Apply patches provided by Oracle immediately for version 9.2.26.3 and restrict network access to the HTTP service.
Original NVD description (English source)
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). The supported version that is affected is 9.2.26.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. While the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).