CVE-2026-60620

MediumCVSS 6.4

Published: 21/07/2026(UTC)Updated: 24/10/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

16th percentile - higher than 16% of all known CVEs

Summary

Vulnerability in the Configuration Management component of JD Edwards EnterpriseOne Configurator (Oracle JD Edwards). A low-privileged attacker via HTTP can cause a complete DoS (hang or frequent crashes) and gain unauthorized data access.

Risk Assessment

Risk of complete configurator downtime and confidentiality/integrity breaches, potentially disrupting product configuration processes.

Recommendation

Apply Oracle patches for version 9.2 and restrict network access to the configurator.

Other vulnerabilities in JD Edwards EnterpriseOne Configurator

CVE-2026-87388Medium
Vulnerability in JD Edwards EnterpriseOne Configurator (Configuration Management component) affecting version 9.2. A low-privileged attacker with HTTP network access can, under difficult conditions, gain unauthorized creation, deletion or modification of critical data.

Original NVD description (English source)

Vulnerability in the JD Edwards EnterpriseOne Configurator product of Oracle JD Edwards (component: Configuration Management). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Configurator. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of JD Edwards EnterpriseOne Configurator as well as unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Configurator accessible data and unauthorized read access to a subset of JD Edwards EnterpriseOne Configurator accessible data. CVSS 3.1 Base Score 6.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H).

Vulnerability data from NVD (NIST) · CISA KEV · EPSS