CVE-2026-60628: Low severity Oracle JD Edwards EnterpriseOne Tools vulnerability
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). The supported version that is affected is 9.2.26.3. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data as well as unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 3.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Apply an Oracle-recommended fix/upgrade for JD Edwards EnterpriseOne Tools Installation Security to address the vulnerability affecting version 9.2.26.3.
JD Edwards EnterpriseOne Tools (Installation Security) Affected supported version = 9.2.26.3 - Compensating control
For Oracle JD Edwards EnterpriseOne Tools (Installation Security), mitigate CVE risk by preventing unauthenticated access via the physical communication segment attached to the hardware where JD Edwards EnterpriseOne Tools executes (e.g., isolate/segregate the physical communication network and restrict it to authorized systems/users).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-60628?
The severity of CVE-2026-60628 is rated low with a score of 3.7.
How do I fix CVE-2026-60628?
To fix CVE-2026-60628, ensure you update your Oracle JD Edwards EnterpriseOne Tools to version 9.2.26.3 or later.
What impact does CVE-2026-60628 have?
CVE-2026-60628 allows for potential unauthorized access by unauthenticated attackers with physical access to the communication segment.
What component is affected by CVE-2026-60628?
The affected component of CVE-2026-60628 is the Installation Security within the JD Edwards EnterpriseOne Tools product.
Who is primarily at risk from CVE-2026-60628?
Organizations using version 9.2.26.3 of Oracle JD Edwards EnterpriseOne Tools are primarily at risk from CVE-2026-60628.