CVE-2026-60956

Analyzed Analyzed - Analysis Complete

Takeover vulnerability in JD Edwards EnterpriseOne US Payroll

Publication date: 2026-08-18

Last updated on: 2026-09-04

Assigner: Oracle

Description

Vulnerability in the JD Edwards EnterpriseOne US Payroll product of Oracle JD Edwards (component: Payroll). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne US Payroll. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne US Payroll. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-09-04

Generated

2026-09-08

AI Q&A

2026-08-19

EPSS Evaluated

2026-09-06

NVD

CVE-2026-60956

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	jd_edwards_enterpriseone_us_payroll	9.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle JD Edwards EnterpriseOne US Payroll version 9.2. It allows a low-privileged attacker with network access to potentially take over the entire payroll system. The attack requires network access via JDENET and is difficult to exploit.

Detection Guidance

Detection requires monitoring network traffic for JDENET protocol usage by unauthorized low-privilege users targeting JD Edwards EnterpriseOne US Payroll version 9.2. Check Oracle's security advisories for patches and review access logs for suspicious activity.

Impact Analysis

If exploited, an attacker could gain full control over the JD Edwards EnterpriseOne US Payroll system. This could lead to unauthorized access to sensitive payroll data, manipulation of payroll records, or disruption of payroll services.

Compliance Impact

This vulnerability allows unauthorized takeover of JD Edwards EnterpriseOne US Payroll, which could lead to unauthorized access or modification of sensitive payroll data. This may impact compliance with GDPR (data protection) and HIPAA (healthcare data privacy) if such data is processed or stored in the system.

Mitigation Strategies

Apply the latest security patches from Oracle for JD Edwards EnterpriseOne US Payroll version 9.2. Restrict network access to JDENET ports and limit privileges for users accessing the system.

Hi! I’m here to help you understand CVE-2026-60956. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70