PatchSiren cyber security CVE debrief

CVE-2026-60497 Oracle Corporation CVE debrief

A high-severity vulnerability was discovered in JD Edwards EnterpriseOne CRM Foundation with a CVSS score of 7.5. The vulnerability is difficult to exploit and allows a low-privileged attacker with network access to compromise the system. This vulnerability is located in the CRM Foundation component of JD Edwards EnterpriseOne. The CVSS vector is CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. Organizations using JD Edwards EnterpriseOne CRM Foundation version 9.2 should prioritize patching this vulnerability to prevent potential takeover of the system.

Vendor: Oracle Corporation
Product: JD Edwards EnterpriseOne CRM Foundation
CVSS: HIGH 7.5
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-07-21
Original CVE updated: 2026-07-25
Advisory published: 2026-07-21
Advisory updated: 2026-07-25

Who should care

Organizations using JD Edwards EnterpriseOne CRM Foundation version 9.2 should prioritize patching this vulnerability to prevent potential takeover of the system. This vulnerability has a high CVSS score of 7.5, indicating high severity. The difficulty in exploitation is high, but successful attacks can have significant impacts.

Technical summary

The vulnerability is located in the CRM Foundation component of JD Edwards EnterpriseOne and has a CVSS vector of CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. Successful attacks can result in confidentiality, integrity, and availability impacts. The vulnerability affects JD Edwards EnterpriseOne CRM Foundation version 9.2. This high-severity vulnerability, with a CVSS score of 7.5, allows a low-privileged attacker with network access via JDENET to potentially take over the system. Organizations should prioritize patching to prevent significant impacts, including takeover of JD Edwards EnterpriseOne CRM Foundation.

Defensive priority

High priority should be given to patching this vulnerability due to its high CVSS score and potential impact on the system.

Recommended defensive actions

Apply the patch provided by the vendor as soon as possible
Conduct a thorough inventory check to identify affected systems
Implement compensating controls to monitor and detect potential attacks
Review and update network access controls to limit exposure
Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record was published on 2026-07-21T22:17:50.803Z and last modified on 2026-07-25T05:16:40.103Z. The NVD entry is currently Awaiting Analysis. This vulnerability affects JD Edwards EnterpriseOne CRM Foundation version 9.2, and its exploitation is difficult, requiring low privileged attacker with network access via JDENET. Successful attacks can result in takeover of JD Edwards EnterpriseOne CRM Foundation.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-21T22:17:50.803Z and has not been modified since then. The NVD entry is currently Awaiting Analysis.