CVE-2026-60346: Low severity Oracle JD Edwards EnterpriseOne Tools vulnerability
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability Security). The supported version that is affected is 9.2.26.3. Difficult to exploit vulnerability allows unauthenticated attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Mitigate the partial denial-of-service risk to JD Edwards EnterpriseOne Tools by restricting network access to JDENET (since the vulnerability is reachable via JDENET by unauthenticated attackers).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-60346?
The severity of CVE-2026-60346 is classified as low with a score of 3.7.
What software is affected by CVE-2026-60346?
CVE-2026-60346 affects the Oracle JD Edwards EnterpriseOne Tools product, specifically version 9.2.26.3.
How does CVE-2026-60346 impact security?
CVE-2026-60346 allows an unauthenticated attacker with network access to compromise JD Edwards EnterpriseOne through JDENET.
What is the risk level associated with CVE-2026-60346?
CVE-2026-60346 has a risk level of 20, indicating a potential security threat that requires attention.
How can I mitigate CVE-2026-60346?
To mitigate CVE-2026-60346, apply recommended security updates or patches provided by Oracle for the affected version.