This vulnerability in JD Edwards EnterpriseOne Tools (version 9.2.26.3) involves the Web Runtime Security component and permits an unauthenticated attacker with network access over HTTP to compromise the system. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability. The attack complexity is high, requiring no privileges or user interaction. Oracle's July 2026 Critical Patch Update advisory references this vulnerability among many others but does not explicitly confirm a dedicated patch or remediation level for it. Customers are advised to review the advisory and apply patches as recommended.

Successful exploitation can result in complete takeover of JD Edwards EnterpriseOne Tools, affecting confidentiality, integrity, and availability of the system. The vulnerability allows unauthenticated remote network access via HTTP, but it is considered difficult to exploit. No known exploits have been reported in the wild at this time.

Oracle's July 2026 Critical Patch Update advisory includes this vulnerability in its list but does not explicitly confirm a dedicated patch or remediation for CVE-2026-60621. Customers should consult the advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and apply any relevant updates promptly. Until an official patch or workaround is confirmed, monitor Oracle's advisories for updates. No vendor-stated 'no action required' or 'already mitigated' status is provided.