# CVE-2026-60627: Oracle JD Edwards EnterpriseOne Tools compromise in Installation Security

Source: https://junglewise.ai/threats/cve-2026-60627-oracle-jd-edwards-enterpriseone-tools-compromise-in-installation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-21. Updated: 2026-07-22  
License: CC BY 4.0 with a link back

CVE-2026-60627 · Severity: critical · CVSS 9.9 · Published 2026-07-21

Oracle JD Edwards EnterpriseOne Tools, a suite of infrastructure software for managing enterprise resource planning (ERP) applications, contains a critical security vulnerability in its Installation Security component. A low-privileged user with network access can exploit this flaw to gain full control over the system. Because this component manages core security and installation functions, a successful attack could allow an unauthorized individual to access sensitive business data, disrupt operations, or compromise other connected enterprise systems.

Technologies: [Oracle JD Edwards EnterpriseOne Tools](https://junglewise.ai/threats/technologies/jd-edwards-enterpriseone-tools). Vendors: [Oracle](https://junglewise.ai/threats/vendors/oracle).

## Quick answers

**Is CVE-2026-60627 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-60627 being exploited in the wild.

**How severe is CVE-2026-60627?** Critical severity, with a CVSS score of 9.9, published 21 July 2026.

**Which products and versions are affected?** Oracle JD Edwards EnterpriseOne Tools 9.2.26.3.

**Is there a fix for CVE-2026-60627?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-60627 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-60627?** Check whether you run Oracle JD Edwards EnterpriseOne Tools at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A critical vulnerability exists in the Installation Security component of Oracle JD Edwards EnterpriseOne Tools version 9.2.26.3. The flaw is classified as easily exploitable, requiring only low-privileged user credentials and network access via HTTP. The vulnerability is notable for its 'Scope Change' (S:C) designation, meaning an exploit can impact components beyond the immediate security scope of the JD Edwards tools. Successful exploitation grants the attacker full control over Confidentiality, Integrity, and Availability (C:H/I:H/A:H), effectively resulting in a complete system takeover. Users are advised to refer to the Oracle Critical Patch Update (CPU) for July 2026 for remediation steps.

## Affected products

- Oracle JD Edwards EnterpriseOne Tools 9.2.26.3

## Timeline

- 2026-07-21: advisory: Oracle published the vulnerability details in the July 2026 CPU.
- 2026-07-21: disclosed: CVE-2026-60627 was published to the NVD.

## References

- [https://www.oracle.com/security-alerts/cpujul2026.html](https://www.oracle.com/security-alerts/cpujul2026.html)

## Related threats

- [Oracle JD Edwards EnterpriseOne Tools CSRF vulnerability](https://junglewise.ai/threats/cve-2026-91455-vulnerability-in-the-jd-edwards-enterpriseone-tools-product-of)
- [Oracle JD Edwards EnterpriseOne Tools unauthorized data access in Web Runtime SEC](https://junglewise.ai/threats/cve-2026-91384-vulnerability-in-the-jd-edwards-enterpriseone-tools-product-of)
- [Oracle JD Edwards EnterpriseOne Tools unauthorized data access in Monitoring and Diagnostics](https://junglewise.ai/threats/cve-2026-91383-vulnerability-in-the-jd-edwards-enterpriseone-tools-product-of)
- [Oracle JD Edwards EnterpriseOne Tools privilege escalation in Installation Security](https://junglewise.ai/threats/cve-2026-91329-vulnerability-in-the-jd-edwards-enterpriseone-tools-product-of)
- [Oracle JD Edwards EnterpriseOne Tools privilege escalation in Deployment SEC](https://junglewise.ai/threats/cve-2026-91328-vulnerability-in-the-jd-edwards-enterpriseone-tools-product-of)