Description
Vulnerability in the JD Edwards EnterpriseOne CRM Foundation product of Oracle JD Edwards (component: CRM Foundation). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne CRM Foundation. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne CRM Foundation. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-07-21
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

This flaw in Oracle JD Edwards EnterpriseOne CRM Foundation version 9.2 is an access‑control weakness that lets a low‑privileged user who can reach the JDENET interface perform privileged operations. Successful exploitation can lead to a complete takeover of the application, exposing confidential data, altering system state, and disrupting availability. The weakness is categorized as CWE‑306.

Affected Systems

Oracle JD Edwards EnterpriseOne CRM Foundation 9.2 is affected. No other product versions or components are listed as vulnerable.

Risk and Exploitability

The CVSS v3.1 base score of 7.5 indicates high severity with confidentiality, integrity, and availability all impacted. The EPSS score of less than 1 % shows an extremely low but non‑zero probability of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a low‑privileged network user who can access the JDENET interface; exploitation requires no additional privileges or special conditions beyond that network access.

Generated by OpenCVE AI on August 4, 2026 at 03:44 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Oracle security patch for JD Edwards EnterpriseOne CRM Foundation 9.2 to fix the access‑control flaw
  • Restrict JDENET network access to trusted hosts only and enforce strong authentication to limit low‑privileged exposure
  • Enable detailed logging and monitoring for JDENET activity, and review logs regularly for anomalous access patterns

Generated by OpenCVE AI on August 4, 2026 at 03:44 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 04 Aug 2026 04:00:00 +0000

Type Values Removed Values Added
Title Access‑Control Weakness in JD Edwards EnterpriseOne CRM Foundation 9.2 Allows Low‑Privileged Compromise

Thu, 30 Jul 2026 14:45:00 +0000

Type Values Removed Values Added
Title Access‑Control Weakness in JD Edwards EnterpriseOne CRM Foundation 9.2 Allows Low‑Privileged Compromise

Mon, 27 Jul 2026 13:15:00 +0000

Type Values Removed Values Added
Title Low Privilege Network Attack Allows Full Compromise of JD Edwards EnterpriseOne CRM Foundation 9.2
Weaknesses CWE-284
CWE-307

Fri, 24 Jul 2026 19:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-306
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 24 Jul 2026 00:00:00 +0000

Type Values Removed Values Added
Title Low Privilege Network Attack Allows Full Compromise of JD Edwards EnterpriseOne CRM Foundation 9.2
Weaknesses CWE-284
CWE-307

Tue, 21 Jul 2026 22:00:00 +0000

Type Values Removed Values Added
Description Vulnerability in the JD Edwards EnterpriseOne CRM Foundation product of Oracle JD Edwards (component: CRM Foundation). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne CRM Foundation. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne CRM Foundation. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle jd Edwards Enterpriseone Crm Foundation
CPEs cpe:2.3:a:oracle:jd_edwards_enterpriseone_crm_foundation:9.2:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle jd Edwards Enterpriseone Crm Foundation
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Jd Edwards Enterpriseone Crm Foundation
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-25T03:55:50.124Z

Reserved: 2026-07-08T15:51:40.541Z

Link: CVE-2026-60497

cve-icon Vulnrichment

Updated: 2026-07-24T17:57:44.757Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T03:45:03Z

Weaknesses
  • CWE-306

    Missing Authentication for Critical Function