CVE-2026-60495: JD Edwards EnterpriseOne RCE Vulnerability

CVE-2026-60495 Overview

CVE-2026-60495 affects Oracle JD Edwards EnterpriseOne Requirements Planning version 9.2. The vulnerability resides in the Requirements Planning component and is exploitable over the network through the JDENET protocol. A low-privileged attacker with network access can compromise the affected system, though exploitation requires overcoming high attack complexity conditions. Successful exploitation results in full takeover of the JD Edwards EnterpriseOne Requirements Planning module, impacting confidentiality, integrity, and availability. Oracle disclosed this vulnerability in the July 2026 Critical Patch Update.

Critical Impact
Successful exploitation allows a low-privileged attacker with network access to take over the JD Edwards EnterpriseOne Requirements Planning product, resulting in full confidentiality, integrity, and availability compromise.

Affected Products

Oracle JD Edwards EnterpriseOne Requirements Planning 9.2
Component: Requirements Planning
Protocol exposure: JDENET network service

Discovery Timeline

2026-07-21 - CVE CVE-2026-60495 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Oracle publishes fix in Critical Patch Update (Oracle Security Alert July 2026)

Technical Details for CVE-2026-60495

Vulnerability Analysis

The vulnerability exists within the Requirements Planning component of Oracle JD Edwards EnterpriseOne 9.2. Attackers reach the flaw through JDENET, the proprietary network protocol used for inter-process communication between JD Edwards services. The flaw enables an authenticated attacker holding low privileges to escalate control over the Requirements Planning product.

Oracle categorizes this as difficult to exploit, indicating that specific runtime conditions or configuration states must align for a successful attack. Once exploited, the attacker achieves full takeover of the Requirements Planning product, impacting business-critical supply chain planning data and workflows.

Root Cause

Oracle has not disclosed detailed root cause information in the public advisory. The issue is scoped to the Requirements Planning component and is triggered through the JDENET service, which handles kernel-to-kernel communication within the JD Edwards EnterpriseOne architecture. Consult the Oracle Security Alert July 2026 for restricted technical details available to licensed customers.

Attack Vector

The attack vector is network-based via JDENET. The attacker must hold valid low-privileged credentials within the JD Edwards environment. No user interaction is required. The scope is unchanged, meaning the compromise is limited to the vulnerable Requirements Planning component. Public exploit code is not available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified proof-of-concept code is publicly available. Refer to Oracle's advisory for authoritative exploitation details restricted to customers under support contracts.

Detection Methods for CVE-2026-60495

Indicators of Compromise

Unexpected JDENET connections from user workstations or non-planner accounts to JD Edwards EnterpriseOne kernel processes.
Unusual invocation patterns or business function calls against Requirements Planning services outside of documented batch schedules.
Requirements Planning configuration or master data changes made by accounts that do not normally administer planning workflows.

Detection Strategies

Enable JD Edwards EnterpriseOne audit logging for Requirements Planning transactions and forward events to a centralized SIEM for correlation.
Baseline normal JDENET traffic between application servers, enterprise servers, and clients, then alert on deviations in source, volume, or call type.
Correlate authentication events for low-privileged JD Edwards users with subsequent Requirements Planning activity to identify privilege abuse.

Monitoring Recommendations

Monitor JD Edwards EnterpriseOne enterprise server logs (jde.log, jdedebug.log) for unusual kernel calls into Requirements Planning modules.
Track network flows to JDENET listener ports and alert on connections originating outside expected application tiers.
Review Requirements Planning batch job history for jobs submitted by accounts without a legitimate business need.

How to Mitigate CVE-2026-60495

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update for JD Edwards EnterpriseOne 9.2 as documented in the Oracle Security Alert July 2026.
Inventory all JD Edwards EnterpriseOne 9.2 deployments that include the Requirements Planning component and prioritize patching.
Rotate credentials for low-privileged JD Edwards accounts and review role assignments to enforce least privilege.

Patch Information

Oracle released fixes for CVE-2026-60495 in the July 2026 Critical Patch Update. Customers should download and apply the applicable JD Edwards EnterpriseOne Tools and Applications updates through My Oracle Support. Consult the Oracle Security Alert July 2026 for the definitive patch matrix, prerequisites, and installation guidance.

Workarounds

Restrict network access to JDENET ports so only trusted application and enterprise server tiers can reach the service.
Remove or reduce Requirements Planning permissions for accounts that do not require them, following least-privilege principles.
Increase monitoring and audit retention for Requirements Planning activity until patches are fully deployed across all environments.

bash

# Example: restrict JDENET access to trusted subnets using host firewall rules
# Adjust the JDENET port to match your environment configuration
iptables -A INPUT -p tcp --dport 6015 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 6015 -j DROP