This vulnerability affects Oracle JD Edwards EnterpriseOne Procurement and Subcontract Management version 9.2. It is easily exploitable by a low privileged attacker with network access via HTTP, enabling compromise of the product. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. The vulnerability is categorized under CWE-306 (Missing Authentication for Critical Function). Oracle's July 2026 Critical Patch Update advisory lists this product and version as affected but does not explicitly confirm a patch or remediation level for this vulnerability. Customers are strongly advised to apply security patches promptly as per Oracle's general guidance.

Successful exploitation can lead to complete compromise of JD Edwards EnterpriseOne Procurement and Subcontract Management version 9.2, impacting confidentiality, integrity, and availability of the system. This could allow an attacker to take over the affected product, potentially disrupting business operations and exposing sensitive procurement and subcontract management data.

Oracle's July 2026 Critical Patch Update advisory includes this vulnerability among others affecting JD Edwards EnterpriseOne Procurement and Subcontract Management version 9.2. However, the advisory does not explicitly confirm the availability of a specific patch for CVE-2026-60618. Customers should review the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and apply all relevant security updates without delay. Until a patch is confirmed and applied, organizations should consider restricting network access to the affected service to trusted users only and monitor for suspicious activity related to this product.