CVE-2026-60492

Analyzed Analyzed - Analysis Complete

Denial of Service in JD Edwards EnterpriseOne HCM Foundation

Publication date: 2026-07-21

Last updated on: 2026-08-06

Assigner: Oracle

Description

Vulnerability in the JD Edwards EnterpriseOne HCM Foundation product of Oracle JD Edwards (component: OW HR PR Foundation). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne HCM Foundation. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of JD Edwards EnterpriseOne HCM Foundation and unauthorized read access to a subset of JD Edwards EnterpriseOne HCM Foundation accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-08-06

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-09

NVD

CVE-2026-60492

EUVD

EUVD-2026-46870

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	jd_edwards_enterpriseone_hcm_foundation	9.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle JD Edwards EnterpriseOne HCM Foundation version 9.2. It allows a low-privileged attacker with network access to cause a denial of service (DOS) or crash the system repeatedly. It also grants unauthorized read access to some data within the affected component.

Detection Guidance

This vulnerability affects JD Edwards EnterpriseOne HCM Foundation version 9.2 and can be exploited via HTTP. Detection involves checking for unusual network traffic or crashes in the application. Monitor logs for repeated crashes or hangs in the HCM Foundation component. Ensure HTTP access is restricted to authorized users only.

Impact Analysis

If exploited, this vulnerability could disrupt your JD Edwards EnterpriseOne HCM Foundation system, causing downtime and preventing users from accessing critical HR functions. It may also expose sensitive data to unauthorized parties.

Compliance Impact

This vulnerability could lead to unauthorized data access, potentially violating GDPR (data protection) and HIPAA (health information privacy) by exposing sensitive personal or health-related data. Compliance may be compromised if the breach affects regulated data.

Mitigation Strategies

Apply the latest security patches from Oracle for JD Edwards EnterpriseOne HCM Foundation version 9.2 to address the vulnerability. Ensure network access controls restrict unauthorized HTTP access to the component. Monitor system logs for unusual activity or crashes related to the HCM Foundation.

Hi! I’m here to help you understand CVE-2026-60492. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70