EUVD-2026-37384Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed JD Edwards EnterpriseOne HTML server
-
DeliveryEnumerate Human Resources Management endpoints
-
ExploitSend crafted unauthenticated HTTP request
-
ExecutionBypass authorization check on HR servlet
-
PersistRead or modify HR records
-
ImpactExfiltrate PII/payroll data
Vulnerability Assessment
| Weakness |
CWE
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker needs network HTTP/HTTPS reachability to an Oracle JD Edwards EnterpriseOne 9.2 deployment that has the Human Resources Management module enabled and exposed via the EnterpriseOne HTML/web server tier; no credentials, no user interaction, and no scope change are required (PR:N/UI:N/S:U). Exploitation is limited by deployment topology - JD Edwards EnterpriseOne is typically segmented behind corporate firewalls or VPN, so realistic exposure depends on whether the HR endpoints are reachable from the attacker's network position, and the issue is scoped only to the 9.2 release with the HR module installed. |
| Impact | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N indicates a network-reachable, low-complexity, no-auth, no-user-interaction flaw with full impact to confidentiality and integrity of HR data, and Oracle itself describes it as 'easily exploitable' - all strong signals that this should be patched promptly on any internet- or partner-exposed JD Edwards tier. Counterweights: there is no CISA KEV listing, no published EPSS score in the provided data, no public POC referenced, and no CWE assigned, so widespread opportunistic exploitation is not yet evidenced. JD Edwards deployments are typically internal/back-office, which narrows the realistic attacker population, but HR data (PII, salary, SSN-equivalent identifiers) makes successful exploitation high-impact from a compliance and insider-threat perspective; treat as a priority patch for any environment where the EnterpriseOne HTML/web server is reachable beyond a hardened admin network. |
| Exploit ScenarioDerived | An attacker who can reach the JD Edwards EnterpriseOne HTML/web server (for example via an exposed intranet portal, partner extranet, or compromised VPN foothold) sends a crafted HTTP request to a Human Resources Management endpoint and, without supplying credentials, reads or modifies HR records such as employee compensation, personal data, or benefits enrollment. No POC is referenced in the available intelligence, but Oracle's own 'easily exploitable / unauthenticated / network' framing suggests a single-request exploitation pattern is plausible once the vulnerable endpoint is identified. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 16, 2026
Unauthenticated remote compromise of Oracle JD Edwards EnterpriseOne Human Resources Management 9.2 allows network attackers to read and modify all data accessible through the Human Resources component via crafted HTTP requests. Oracle rates this CVSS 9.1 with high confidentiality and integrity impact but no availability impact, and labels it 'easily exploitable.' No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
RemediationAI
Apply the fixes from the Oracle Critical Patch Update of June 2026 (https://www.oracle.com/security-alerts/cspujun2026.html); the advisory bundles the JD Edwards EnterpriseOne Human Resources Management 9.2 patch - install the CPU-referenced bundle/Tools release for your 9.2 environment as soon as your change window permits, since exact fix version is published only inside the CPU matrix. Until patching, restrict network reachability of the EnterpriseOne HTML/web server to trusted admin networks via firewall or reverse-proxy ACLs, require VPN/SSO in front of the HR module URLs, and monitor web logs for anomalous unauthenticated requests to Human Resources servlets - note this will break any legitimate cross-segment HR self-service traffic and may require coordination with HR business owners.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
JD Edwards EnterpriseOne is Oracle's ERP suite; the Human Resources Management module exposes HR workflows over HTTP through the EnterpriseOne web/HTML server tier. The advisory does not assign a CWE, but the combination of unauthenticated network access with full read/write impact and no availability effect - together with the 'Authentication Bypass' tag in the intel feed - is consistent with a missing or broken authentication/authorization check on an HR servlet or service endpoint that should require a valid EnterpriseOne session. CPE coverage is limited to the JD Edwards EnterpriseOne Human Resources Management product line at version 9.2.
Know when Jd Edwards Enterpriseone Human Resources Management gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
HTTP-reachable HR module exploitable without credentials or user interaction (AV:N/AC:L/PR:N/UI:N); full read/write to HR data (C:H/I:H) with no availability impact described (A:N).
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the JD Edwards EnterpriseOne Human Resources Management product of Oracle JD Edwards (component: Human Resources). The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Human Resources Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Human Resources Management accessible data as well as unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Human Resources Management accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
Executive ViewAI
Oracle JD Edwards EnterpriseOne Human Resources Management version 9.2 is vulnerable to unauthenticated remote attacks that allow attackers to read and modify all human resources data, including employee records, compensation, and benefits information. No patch is currently available from Oracle, leaving organizations dependent on mitigation controls until a fix is released.
No vendor-released patch identified at time of analysis. Interim mitigations: Implement network segmentation isolating the HR module from untrusted networks, deploy Web Application Firewall rules to block anomalous HTTP requests to HR endpoints, enforce multi-factor authentication for all HR system access, enable comprehensive audit logging of all HR module transactions with daily log review, and perform weekly integrity validation of critical HR tables for unauthorized modifications.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Product takeover in Oracle JD Edwards EnterpriseOne Human Resources Management 9.2 allows an authenticated low-privilege
Full takeover of Oracle JD Edwards EnterpriseOne Human Resources Management 9.2 is possible when a low-privileged attack
GitHub PoC
Exploit-DB