CVE-2026-60497 Oracle Corporation CVE debrief

Who should care

Organizations using JD Edwards EnterpriseOne CRM Foundation version 9.2 should prioritize patching this vulnerability to prevent potential takeover of the system. This vulnerability has a high CVSS score of 7.5, indicating high severity. The difficulty in exploitation is high, but successful attacks can have significant impacts.

Technical summary

The vulnerability is located in the CRM Foundation component of JD Edwards EnterpriseOne and has a CVSS vector of CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. Successful attacks can result in confidentiality, integrity, and availability impacts. The vulnerability affects JD Edwards EnterpriseOne CRM Foundation version 9.2. This high-severity vulnerability, with a CVSS score of 7.5, allows a low-privileged attacker with network access via JDENET to potentially take over the system. Organizations should prioritize patching to prevent significant impacts, including takeover of JD Edwards EnterpriseOne CRM Foundation.

Defensive priority

High priority should be given to patching this vulnerability due to its high CVSS score and potential impact on the system.

Recommended defensive actions

• Apply the patch provided by the vendor as soon as possible
• Conduct a thorough inventory check to identify affected systems
• Implement compensating controls to monitor and detect potential attacks
• Review and update network access controls to limit exposure
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record was published on 2026-07-21T22:17:50.803Z and last modified on 2026-07-25T05:16:40.103Z. The NVD entry is currently Awaiting Analysis. This vulnerability affects JD Edwards EnterpriseOne CRM Foundation version 9.2, and its exploitation is difficult, requiring low privileged attacker with network access via JDENET. Successful attacks can result in takeover of JD Edwards EnterpriseOne CRM Foundation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.