EUVD-2026-37231Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed EnterpriseOne Tools HTTP endpoint
-
DeliverySend crafted request to Web Runtime Security
-
ExploitBypass authentication check
-
ExecutionIssue authorized API calls as trusted principal
-
PersistExfiltrate accessible business data
-
ImpactModify permitted records across scoped applications
Vulnerability Assessment
| Weakness |
CWE
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network HTTP reachability to a JD Edwards EnterpriseOne Tools Web Runtime Security endpoint on a version in the 9.2.0.0-9.2.26.2 range; no credentials, no user interaction, and no special non-default configuration are called out by Oracle, consistent with AV:N/AC:L/PR:N/UI:N. Practical limiters are deployment-side rather than vulnerability-side: instances reachable only from internal management VLANs or fronted by an authenticating reverse proxy substantially reduce exposure, and customers already on a post-9.2.26.2 Tools release delivered in the June 2026 CPU are out of scope. Availability impact is None (A:N), so this is a data-confidentiality and integrity event, not a service-outage event. |
| Impact | Signals converge toward high real-world priority: CVSS 3.1 is 9.3 with AV:N/AC:L/PR:N/UI:N/S:C, meaning network reachable, low complexity, no authentication, no user interaction, and a scope change - the standard profile of an internet- or intranet-exposed pre-auth flaw on an ERP middleware tier. Confidentiality impact is High and Integrity is Low (read everything, modify some), while Availability is None, so denial of service is not the primary concern but data theft and selective tampering of business records are. EPSS, KEV, and SSVC values are not present in the input, so probabilistic exploitation likelihood and CISA prioritization cannot be confirmed - absence of KEV does not mean the issue is safe, only that active exploitation has not been catalogued. The Oracle Critical Patch Update channel is a routine target for reverse engineering after release, and ERP middleware is high value, so defenders should treat this on the Oracle CPU emergency-patch track regardless of the missing EPSS signal. |
| Exploit ScenarioDerived | An attacker who can reach the JD Edwards EnterpriseOne Tools HTTP interface from the network sends a crafted request to a Web Runtime Security endpoint that bypasses authentication, then issues follow-on HTTP calls as an implicitly trusted principal to read business data and perform a limited set of writes across the downstream EnterpriseOne applications reachable through the scope change. No public exploit identified at time of analysis, but the AC:L / PR:N / UI:N vector means weaponization after patch-diffing is a realistic near-term outcome for an ERP-focused threat actor. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 16, 2026
Unauthenticated remote compromise of Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.2 via the Web Runtime Security component allows attackers with HTTP access to read all data the product can reach and modify a subset of it, with a scope change that propagates impact to other integrated products. Oracle rates the issue 9.3 (CVSS 3.1) and describes it as easily exploitable, and the public tagging as an authentication bypass aligns with the PR:N vector. No public exploit identified at time of analysis and no CISA KEV listing has been recorded.
RemediationAI
Apply the fix delivered in the Oracle Critical Patch Update of June 2026 as documented at https://www.oracle.com/security-alerts/cspujun2026.html - patch available per vendor advisory; the exact post-9.2.26.2 patched build should be taken from the CPU matrix because the input data does not enumerate a specific fixed release number. Until the CPU is deployed, restrict reachability of the JD Edwards EnterpriseOne HTML Server, Server Manager, and AIS endpoints to trusted management networks via firewall or reverse-proxy ACLs (trade-off: breaks remote administrative and integration access from outside that range), require a VPN or zero-trust proxy in front of the HTTP listener, and enable enhanced web-tier logging plus WAF rules that block anomalous authentication and session-cookie patterns directed at the Web Runtime Security endpoints (trade-off: signature-based WAF rules can be bypassed by minor protocol variation, so treat as detection, not prevention). Do not rely on disabling user accounts - the flaw is pre-authentication, so account hardening alone will not mitigate it.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
JD Edwards EnterpriseOne Tools is the runtime, administration, and middleware layer (HTML Server, Server Manager, AIS/JAS web tier) that fronts JD Edwards ERP applications. The flaw sits in the Web Runtime Security subsystem - the code path that enforces authentication and session handling for HTTP-facing services - and the description plus the 'Authentication Bypass' tag indicate the security check can be skipped or coerced over the network. CWE is not assigned in the input, but the behavior (no privileges required, scope change to downstream business modules) is consistent with the CWE-287/CWE-863 authentication or authorization bypass family rather than a memory-corruption class issue. The single CPE (cpe:2.3:a:oracle_corporation:jd_edwards_enterpriseone_tools) confirms the EnterpriseOne Tools tier is the only directly vulnerable product, but the CVSS S:C scope change means attacks pivot into the EnterpriseOne applications and integrated data stores that Tools mediates.
Know when Jd Edwards Enterpriseone Tools gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
Network-reachable HTTP endpoint with no auth or user interaction (AV:N/AC:L/PR:N/UI:N); scope change into downstream apps (S:C); full read but partial write and no DoS (C:H/I:L/A:N).
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime Security). Supported versions that are affected are 9.2.0.0-9.2.26.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. While the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data as well as unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 9.3 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N).
Executive ViewAI
Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.2 contain a critical authentication bypass allowing unauthenticated attackers to read all accessible data and modify critical subsets, with impact extending to integrated applications. This vulnerability poses immediate data breach and integrity risks for any organization running these versions, particularly those managing financial and HR data. No vendor patch is available; organizations must implement immediate network and application-level compensating controls.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict HTTP access via firewall and network segmentation; (2) Deploy WAF rules targeting authentication bypass techniques; (3) Implement enhanced logging and monitoring for unauthorized data access; (4) Disable unnecessary integrations until patched; (5) Maintain continuous monitoring for patch availability from Oracle.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events
In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Rated cri
The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly
In OpenSSL 1.1.0 before 1.1.0d, if a malicious server supplies bad parameters for a DHE or ECDHE key exchange then this
A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL proto
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, rela
jQuery-UI is the official jQuery user interface library. Rated medium severity (CVSS 6.1), this vulnerability is remotel
An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. Rated med
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, rela
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, rela
It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. Rated critical severity (CVS
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, rela
GitHub PoC
Exploit-DB