EUVD-2026-37384Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
HTTP-reachable HR module exploitable without credentials or user interaction (AV:N/AC:L/PR:N/UI:N); full read/write to HR data (C:H/I:H) with no availability impact described (A:N).
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the JD Edwards EnterpriseOne Human Resources Management product of Oracle JD Edwards (component: Human Resources). The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Human Resources Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Human Resources Management accessible data as well as unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Human Resources Management accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
AnalysisAI
Unauthenticated remote compromise of Oracle JD Edwards EnterpriseOne Human Resources Management 9.2 allows network attackers to read and modify all data accessible through the Human Resources component via crafted HTTP requests. Oracle rates this CVSS 9.1 with high confidentiality and integrity impact but no availability impact, and labels it 'easily exploitable.' No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Technical ContextAI
JD Edwards EnterpriseOne is Oracle's ERP suite; the Human Resources Management module exposes HR workflows over HTTP through the EnterpriseOne web/HTML server tier. The advisory does not assign a CWE, but the combination of unauthenticated network access with full read/write impact and no availability effect - together with the 'Authentication Bypass' tag in the intel feed - is consistent with a missing or broken authentication/authorization check on an HR servlet or service endpoint that should require a valid EnterpriseOne session. CPE coverage is limited to the JD Edwards EnterpriseOne Human Resources Management product line at version 9.2.
RemediationAI
Apply the fixes from the Oracle Critical Patch Update of June 2026 (https://www.oracle.com/security-alerts/cspujun2026.html); the advisory bundles the JD Edwards EnterpriseOne Human Resources Management 9.2 patch - install the CPU-referenced bundle/Tools release for your 9.2 environment as soon as your change window permits, since exact fix version is published only inside the CPU matrix. Until patching, restrict network reachability of the EnterpriseOne HTML/web server to trusted admin networks via firewall or reverse-proxy ACLs, require VPN/SSO in front of the HR module URLs, and monitor web logs for anomalous unauthenticated requests to Human Resources servlets - note this will break any legitimate cross-segment HR self-service traffic and may require coordination with HR business owners.
Product takeover in Oracle JD Edwards EnterpriseOne Human Resources Management 9.2 allows an authenticated low-privilege
Full takeover of Oracle JD Edwards EnterpriseOne Human Resources Management 9.2 is possible when a low-privileged attack
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today