This vulnerability affects Oracle JD Edwards EnterpriseOne Tools, specifically version 9.2.26.3. It is difficult to exploit and requires the attacker to have low privileged logon access to the infrastructure hosting the tools. Successful exploitation can result in unauthorized modification (update, insert, delete) of some accessible data and partial denial of service conditions affecting the product. The CVSS 3.1 vector indicates local attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and low availability impact. No official patch or remediation level is explicitly stated in the vendor advisory, but Oracle's July 2026 Critical Patch Update advisory references this vulnerability among others and recommends applying available patches promptly. No known exploits in the wild have been reported.

The impact includes unauthorized ability to update, insert, or delete some data accessible by JD Edwards EnterpriseOne Tools and the potential to cause a partial denial of service. Confidentiality is not affected. The overall severity is low due to the difficulty of exploitation and limited scope of impact.

Oracle's July 2026 Critical Patch Update advisory includes this vulnerability among many others but does not explicitly state a dedicated patch or remediation level for CVE-2026-60347. Customers are strongly advised to remain on actively supported versions and apply Oracle Critical Patch Updates without delay to mitigate this and other vulnerabilities. Since the vulnerability requires local logon access with low privileges and has high attack complexity, limiting access to the infrastructure and following Oracle's patching guidance is recommended. Patch status is not yet confirmed specifically for this CVE; check Oracle's advisory for the latest remediation information.