CVE-2026-60490: JD Edwards EnterpriseOne RCE Vulnerability

CVE-2026-60490 Overview

CVE-2026-60490 is a high-severity vulnerability in the Oracle JD Edwards EnterpriseOne CRM Foundation product, affecting the CRM Foundation component in version 9.2. The flaw allows a low-privileged attacker with network access over HTTP to compromise the application. Successful exploitation results in full takeover of the JD Edwards EnterpriseOne CRM Foundation, impacting confidentiality, integrity, and availability. Oracle addressed the issue in its July 2026 Critical Patch Update.

Critical Impact
Authenticated attackers can achieve complete takeover of JD Edwards EnterpriseOne CRM Foundation deployments over the network with low attack complexity.

Affected Products

Oracle JD Edwards EnterpriseOne CRM Foundation, version 9.2
Component: CRM Foundation
Protocol exposure: HTTP

Discovery Timeline

2026-07-21 - CVE-2026-60490 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Oracle releases fix in the Oracle Critical Patch Update Advisory - July 2026

Technical Details for CVE-2026-60490

Vulnerability Analysis

The vulnerability resides in the CRM Foundation component of Oracle JD Edwards EnterpriseOne, an enterprise resource planning (ERP) suite used to manage customer relationship management processes. According to Oracle's advisory, the flaw is easily exploitable and requires only low privileges combined with network access via HTTP. No user interaction is needed to trigger the condition.

Successful exploitation yields full takeover of the CRM Foundation, meaning an attacker can read, modify, or destroy business-critical CRM data and disrupt service. The scope remains unchanged, but the confidentiality, integrity, and availability impacts are all rated high. Oracle has not published detailed technical root-cause information in the public advisory.

Root Cause

Oracle's July 2026 Critical Patch Update lists the issue against the CRM Foundation component of JD Edwards EnterpriseOne 9.2. The advisory does not disclose the specific weakness class, and no CWE identifier is assigned in the NVD entry. Practitioners should treat the root cause as an authenticated network-facing flaw in HTTP request handling within CRM Foundation until Oracle publishes further detail.

Attack Vector

The attack vector is network-based over HTTP. An attacker requires a valid low-privileged account on the target JD Edwards EnterpriseOne instance. From that position, the adversary sends crafted HTTP requests to the CRM Foundation endpoints exposed by the application server. No victim interaction is required, and the attack complexity is low, which reduces the operational barrier for exploitation once credentials are obtained through phishing, credential stuffing, or insider access.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score at publication is 0.328% (percentile 25.176), indicating low predicted near-term exploitation activity. See the Oracle Critical Patch Update Advisory - July 2026 for vendor-supplied technical references.

Detection Methods for CVE-2026-60490

Indicators of Compromise

Unexpected HTTP requests from low-privileged JD Edwards accounts to CRM Foundation endpoints
Creation, modification, or deletion of CRM records outside of documented business workflows
New administrative accounts or role changes inside JD Edwards EnterpriseOne shortly after suspicious HTTP activity
Anomalous outbound connections from the JD Edwards application server hosts

Detection Strategies

Review JD Edwards EnterpriseOne audit logs for CRM Foundation actions performed by accounts that do not normally use those functions
Alert on HTTP requests to CRM Foundation URLs containing unusual parameters, oversized payloads, or non-standard methods
Correlate authentication events with CRM record changes to surface privilege abuse originating from low-privileged sessions

Monitoring Recommendations

Forward JD Edwards application, web, and database logs to a central SIEM for retention and correlation
Baseline normal CRM Foundation HTTP traffic volumes and alert on deviations per user account
Monitor east-west traffic from JD Edwards servers to identify post-compromise lateral movement attempts

How to Mitigate CVE-2026-60490

Immediate Actions Required

Apply the fixes from the Oracle Critical Patch Update Advisory - July 2026 to all JD Edwards EnterpriseOne 9.2 deployments
Inventory internet-exposed JD Edwards CRM Foundation instances and restrict them behind VPN or reverse proxy controls
Rotate credentials for low-privileged JD Edwards accounts and enforce multi-factor authentication where supported
Review recent CRM Foundation activity logs for signs of prior exploitation

Patch Information

Oracle released the fix as part of the July 2026 Critical Patch Update. Administrators should follow the patch matrix in the Oracle Critical Patch Update Advisory - July 2026 and apply the JD Edwards EnterpriseOne Tools update that corresponds to the CRM Foundation component. Oracle recommends applying Critical Patch Updates without delay.

Workarounds

Restrict HTTP access to CRM Foundation endpoints using network ACLs or a web application firewall until patches are deployed
Reduce the number of accounts with any level of access to JD Edwards EnterpriseOne, applying least-privilege principles
Disable or gate CRM Foundation functionality that is not actively used by business processes
Increase logging verbosity for CRM Foundation transactions to support forensic review

bash

# Example: restrict HTTP access to the JD Edwards CRM Foundation service to trusted subnets
# (adjust interface, port, and source ranges to match your environment)
iptables -A INPUT -p tcp --dport 8080 -s 10.10.0.0/16 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP