CVE-2026-60628

Analyzed Analyzed - Analysis Complete

Unauthenticated Data Access in JD Edwards EnterpriseOne Tools

Publication date: 2026-07-21

Last updated on: 2026-08-06

Assigner: Oracle

Description

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). The supported version that is affected is 9.2.26.3. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data as well as unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 3.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-08-06

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-09

NVD

CVE-2026-60628

EUVD

EUVD-2026-46986

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	jd_edwards_enterpriseone_tools	9.2.26.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle JD Edwards EnterpriseOne Tools version 9.2.26.3. It allows an unauthenticated attacker on the same physical network segment to potentially compromise the system. Exploitation requires some interaction from another user and could lead to unauthorized data access or modification.

Detection Guidance

Detection requires monitoring network traffic for unauthorized access attempts to JD Edwards EnterpriseOne Tools. Check logs for unusual data modification or access patterns. Since the vulnerability requires physical network access and human interaction, inspect network segments connected to the system for suspicious activity.

Impact Analysis

If exploited, this vulnerability could allow attackers to read or modify some data within JD Edwards EnterpriseOne Tools. This might lead to data breaches, unauthorized changes to business data, or other security incidents depending on the system's use.

Compliance Impact

This vulnerability allows unauthorized read and limited write access to data in JD Edwards EnterpriseOne Tools. This could potentially expose sensitive data, which may impact compliance with GDPR (data confidentiality requirements) and HIPAA (protected health information security). However, the specific impact depends on the data processed and stored in the affected system.

Mitigation Strategies

Isolate the affected JD Edwards EnterpriseOne Tools system from untrusted networks. Apply the latest security patches from Oracle. Restrict physical access to the network segment where the system operates. Monitor for unauthorized data changes or access.

Hi! I’m here to help you understand CVE-2026-60628. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70