CVE-2026-60489

Analyzed Analyzed - Analysis Complete

Takeover vulnerability in JD Edwards EnterpriseOne CRM Foundation

Publication date: 2026-07-21

Last updated on: 2026-08-06

Assigner: Oracle

Description

Vulnerability in the JD Edwards EnterpriseOne CRM Foundation product of Oracle JD Edwards (component: CRM Foundation). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne CRM Foundation. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne CRM Foundation. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-08-06

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-09

NVD

CVE-2026-60489

EUVD

EUVD-2026-46867

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	jd_edwards_enterpriseone_crm_foundation	9.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle JD Edwards EnterpriseOne CRM Foundation version 9.2. It allows a low-privileged attacker with network access to take over the system via HTTP. The attack can impact confidentiality, integrity, and availability of the system.

Detection Guidance

Detection requires checking for vulnerable versions of JD Edwards EnterpriseOne CRM Foundation 9.2. Verify installed versions against Oracle's security advisories and patch levels. Monitor network traffic for unusual HTTP requests targeting the CRM Foundation component.

Impact Analysis

An attacker could gain full control of the JD Edwards EnterpriseOne CRM Foundation system, leading to unauthorized access, data theft, system manipulation, or disruption of services.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate compliance requirements under GDPR, HIPAA, or other regulations due to potential exposure of sensitive data.

Mitigation Strategies

Apply the latest security patches from Oracle for JD Edwards EnterpriseOne CRM Foundation version 9.2. Restrict network access to HTTP ports used by the CRM Foundation component. Monitor for unusual activity or unauthorized access attempts.

Hi! I’m here to help you understand CVE-2026-60489. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70