Summary
CVE-2026-60621 is a high-severity vulnerability in the Web Runtime Security component of Oracle JD Edwards EnterpriseOne Tools, affecting version 9.2.26.3. An unauthenticated remote attacker with network access via HTTP can exploit this flaw to achieve complete takeover of affected JD Edwards EnterpriseOne Tools instances. Disclosed as part of Oracle’s Critical Patch Update (CPU) for July 2026, the vulnerability carries a CVSS v3.1 base score of 8.1 (HIGH).
Technical details
- Affected component: Web Runtime Security component of Oracle JD Edwards EnterpriseOne Tools
- Attack vector: Exploitable remotely over HTTP with no authentication and no user interaction required
- Attack complexity: Oracle describes this as a "difficult-to-exploit" vulnerability (CVSS AC:H), meaning specific conditions must be met for successful exploitation
- Impact: Successful exploitation results in complete takeover of the JD Edwards EnterpriseOne Tools instance, with High impact to Confidentiality, Integrity, and Availability
- No public proof-of-concept has been identified at the time of publication
Affected software
- Oracle JD Edwards EnterpriseOne Tools version 9.2.26.3
Severity
- CVSS v3.1 Base Score: 8.1 (HIGH)
- Vector String:
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Mitigation and recommended actions
- Immediate: Apply the security patch provided by Oracle as part of the July 2026 Critical Patch Update. Patch availability details for JD Edwards EnterpriseOne are documented in Oracle’s CPU275 support document, accessible through the Oracle Support portal.
- Oracle strongly recommends that customers apply Critical Patch Update security patches as soon as possible.
- If immediate patching is not feasible, restrict network access to all JD Edwards EnterpriseOne web-facing interfaces (HTML Web Client, AIS/Orchestrator REST endpoints) to trusted IP ranges only, and avoid direct internet exposure of these services.
IONIX Status
The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.

