CVE-2026-60628: JD Edwards EnterpriseOne Auth Bypass

CVE-2026-60628 Overview

CVE-2026-60628 affects the Installation Security component of Oracle JD Edwards EnterpriseOne Tools version 9.2.26.3. An unauthenticated attacker with access to the physical communication segment attached to the target hardware can compromise JD Edwards EnterpriseOne Tools. Exploitation is difficult and requires human interaction from a user other than the attacker. Successful attacks can result in unauthorized read, insert, update, or delete access to a subset of JD Edwards EnterpriseOne Tools accessible data.

Critical Impact
Adjacent-network attackers may gain limited unauthorized read and write access to JD Edwards EnterpriseOne Tools data when a user is tricked into interacting with the attack payload.

Affected Products

Oracle JD Edwards EnterpriseOne Tools 9.2.26.3
Component: Installation Security
Vendor: Oracle Corporation

Discovery Timeline

2026-07-21 - CVE-2026-60628 published to NVD
2026-07-21 - Oracle Critical Patch Update July 2026 released
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-60628

Vulnerability Analysis

The vulnerability resides in the Installation Security component of JD Edwards EnterpriseOne Tools. An attacker positioned on the same physical communication segment as the target host can attempt to compromise the installation process. Exploitation is rated as high complexity and requires user interaction, which limits practical abuse to targeted scenarios.

Successful exploitation yields limited confidentiality and integrity impact. The attacker gains read access to a subset of accessible data and can insert, update, or delete some data. Availability is not affected. The attack scope remains unchanged, meaning the impact is contained to resources managed by the vulnerable component.

Root Cause

Oracle has not published detailed root-cause analysis. The vulnerability class is tied to the Installation Security subsystem, which handles trust and validation during Tools installation workflows. Refer to the Oracle Security Alert July 2026 for vendor-provided details.

Attack Vector

The attack vector is Adjacent Network. The attacker must have a foothold on the same broadcast domain, VLAN, or physical network segment as the JD Edwards EnterpriseOne Tools host. A legitimate user must also perform an action such as initiating or interacting with an installation workflow. Because no verified public exploit or proof-of-concept is available, exploitation details are described here in prose rather than code.

Detection Methods for CVE-2026-60628

Indicators of Compromise

Unexpected modifications to JD Edwards EnterpriseOne Tools configuration or installation artifacts on hosts running version 9.2.26.3.
Anomalous traffic on the local network segment targeting JD Edwards install or update endpoints.
Unauthorized data changes in EnterpriseOne Tools tables lacking a corresponding administrative change record.

Detection Strategies

Monitor Oracle JD Edwards audit logs for unauthorized insert, update, or delete operations against Tools-managed data.
Correlate installation or Tools upgrade events with the identity of the initiating user and the source network segment.
Alert on hosts in the JD Edwards network segment initiating unexpected broadcast, ARP spoofing, or man-in-the-middle activity.

Monitoring Recommendations

Enable and centralize JD Edwards EnterpriseOne Tools audit logging to a SIEM for long-term retention.
Baseline normal installation and update activity, then alert on deviations such as off-hours execution or unfamiliar operators.
Track EPSS scoring for CVE-2026-60628, currently at 0.152% (percentile 4.849), to detect changes that indicate emerging exploitation.

How to Mitigate CVE-2026-60628

Immediate Actions Required

Apply the Oracle Critical Patch Update from July 2026 to all JD Edwards EnterpriseOne Tools 9.2.26.3 deployments.
Restrict physical and logical access to the network segments where JD Edwards EnterpriseOne Tools hosts operate.
Require administrator-level review before executing installation or Tools upgrade workflows.

Patch Information

Oracle addressed CVE-2026-60628 in the July 2026 Critical Patch Update. Review the Oracle Security Alert July 2026 advisory for the corresponding Tools patch identifiers and installation instructions. Validate patch application on all systems running JD Edwards EnterpriseOne Tools 9.2.26.3.

Workarounds

Segment JD Edwards EnterpriseOne Tools hosts onto dedicated VLANs with strict access control lists.
Enforce 802.1X or equivalent network access control to prevent unauthorized devices from joining the adjacent segment.
Train administrators to verify installation prompts and reject unexpected user-interaction requests during Tools operations.

bash

# Example: restrict access to JD Edwards Tools segment with iptables
iptables -A INPUT -i eth0 -s 10.10.20.0/24 -p tcp --dport 6015 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --dport 6015 -j DROP