CVE-2026-60497: Difficult to exploit vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne CRM Foundation. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne CRM Foundation. in Oracle Corporation JD Edwards EnterpriseOne CRM Foundation
Vulnerability in the JD Edwards EnterpriseOne CRM Foundation product of Oracle JD Edwards (component: CRM Foundation). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne CRM Foundation. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne CRM Foundation. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
AI Analysis
Technical Summary
This vulnerability affects Oracle JD Edwards EnterpriseOne CRM Foundation version 9.2. It permits a low privileged attacker with network access through JDENET to compromise the CRM Foundation component, potentially resulting in full takeover. The CVSS 3.1 vector indicates network attack vector (AV:N), high attack complexity (AC:H), low privileges required (PR:L), no user interaction (UI:N), unchanged scope (S:U), and high impact on confidentiality, integrity, and availability (C:H/I:H/A:H). Oracle has addressed this vulnerability in its July 2026 Critical Patch Update, which includes patches for JD Edwards EnterpriseOne CRM Foundation 9.2 among many other products.
Potential Impact
Successful exploitation can lead to complete compromise of the JD Edwards EnterpriseOne CRM Foundation component, impacting confidentiality, integrity, and availability of the system. This could allow an attacker to take over the affected system with potentially severe consequences for business operations and data security.
Mitigation Recommendations
Oracle has released patches for this vulnerability as part of the July 2026 Critical Patch Update. Users of JD Edwards EnterpriseOne CRM Foundation version 9.2 should apply the relevant patches promptly to remediate the vulnerability. No alternative mitigations or workarounds are specified in the advisory. Patch status is confirmed by the vendor advisory.
CVE-2026-60497: Difficult to exploit vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne CRM Foundation. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne CRM Foundation. in Oracle Corporation JD Edwards EnterpriseOne CRM Foundation
Description
Vulnerability in the JD Edwards EnterpriseOne CRM Foundation product of Oracle JD Edwards (component: CRM Foundation). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne CRM Foundation. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne CRM Foundation. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS v3.1
Score 7.5high
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability affects Oracle JD Edwards EnterpriseOne CRM Foundation version 9.2. It permits a low privileged attacker with network access through JDENET to compromise the CRM Foundation component, potentially resulting in full takeover. The CVSS 3.1 vector indicates network attack vector (AV:N), high attack complexity (AC:H), low privileges required (PR:L), no user interaction (UI:N), unchanged scope (S:U), and high impact on confidentiality, integrity, and availability (C:H/I:H/A:H). Oracle has addressed this vulnerability in its July 2026 Critical Patch Update, which includes patches for JD Edwards EnterpriseOne CRM Foundation 9.2 among many other products.
Potential Impact
Successful exploitation can lead to complete compromise of the JD Edwards EnterpriseOne CRM Foundation component, impacting confidentiality, integrity, and availability of the system. This could allow an attacker to take over the affected system with potentially severe consequences for business operations and data security.
Mitigation Recommendations
Oracle has released patches for this vulnerability as part of the July 2026 Critical Patch Update. Users of JD Edwards EnterpriseOne CRM Foundation version 9.2 should apply the relevant patches promptly to remediate the vulnerability. No alternative mitigations or workarounds are specified in the advisory. Patch status is confirmed by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- oracle
- Date Reserved
- 2026-07-08T15:51:40.541Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://www.oracle.com/security-alerts/cpujul2026.html","vendor":"Oracle"}]
Threat ID: 6a5fedee9c2644c7f8d59b1b
Added to database: 07/21/2026, 22:08:46 UTC
Last enriched: 07/30/2026, 02:04:55 UTC
Last updated: 09/04/2026, 10:52:10 UTC
Views: 48
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.