This vulnerability affects Oracle JD Edwards EnterpriseOne HCM Foundation version 9.2, particularly the Time Accounting and HRM Base component. It permits a low privileged attacker with network access via HTTP to compromise the system, potentially resulting in full takeover. The vulnerability is rated with a CVSS 3.1 base score of 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating network attack vector, high attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The vulnerability is tracked as CVE-2026-60619. Oracle has published a Critical Patch Update advisory in July 2026 that includes patches for this and many other vulnerabilities affecting JD Edwards EnterpriseOne HCM Foundation 9.2 among other products. No explicit patch link is provided in the input, but the vendor advisory is the authoritative source for patch availability.

Successful exploitation of this vulnerability can lead to a complete takeover of the JD Edwards EnterpriseOne HCM Foundation system, impacting confidentiality, integrity, and availability of the affected product. The attacker requires only low privileges and network access via HTTP, although the attack complexity is high. This could allow unauthorized access to sensitive HR and time accounting data and disrupt business operations.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. Customers should refer to the official Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for patch availability and installation instructions. Applying the relevant patches from this Critical Patch Update is the recommended remediation. There is no indication that the vulnerability is already mitigated or that no action is required. Patch status is confirmed as available through the vendor advisory.