CVE-2026-60496

Received Received - Intake

Takeover vulnerability in JD Edwards EnterpriseOne Advanced Pricing

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: Oracle

Description

Vulnerability in the JD Edwards EnterpriseOne Advanced Pricing - Procurement product of Oracle JD Edwards (component: Advanced Pricing). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Advanced Pricing - Procurement. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Advanced Pricing - Procurement. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-21

Generated

2026-07-22

AI Q&A

2026-07-22

EPSS Evaluated

N/A

NVD

CVE-2026-60496

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	jd_edwards_enterpriseone_advanced_pricing	9.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle JD Edwards EnterpriseOne Advanced Pricing - Procurement version 9.2. It allows a low-privileged attacker with network access to take over the system via JDENET. The attack requires network access but no user interaction. Successful exploitation can lead to full compromise of the Advanced Pricing component.

Detection Guidance

Detection requires monitoring JD Edwards EnterpriseOne Advanced Pricing - Procurement for unusual network activity or unauthorized access attempts via JDENET. Check logs for suspicious connections or privilege escalation patterns. No specific commands are provided in the available context.

Impact Analysis

If exploited, this vulnerability could allow an attacker to take complete control of the JD Edwards EnterpriseOne Advanced Pricing - Procurement system. This may lead to unauthorized access to sensitive data, modification of pricing or procurement rules, disruption of services, or further network infiltration.

Mitigation Strategies

Apply Oracle's official security patches or updates for JD Edwards EnterpriseOne Advanced Pricing - Procurement version 9.2. Restrict network access to JDENET ports and enforce least privilege for users. Monitor for exploitation attempts and isolate affected systems if compromised.

Hi! I’m here to help you understand CVE-2026-60496. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70