EUVD-2026-46761
GHSA-pxhg-2qmv-xcg7
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L
Local attack vector with low-privilege requirement and high complexity align with infrastructure logon dependency; no confidentiality impact described, only partial integrity and availability.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure Security). The supported version that is affected is 9.2.26.3. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 3.6 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L).
AnalysisAI
Local privilege abuse in Oracle JD Edwards EnterpriseOne Tools 9.2.26.3 allows a low-privileged attacker with infrastructure logon access to perform unauthorized data modifications and induce a partial denial of service against the Enterprise Infrastructure Security component. The attack complexity is rated High, meaning specific conditions beyond the attacker's direct control must be met. No public exploit code exists and this vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog, placing it in a low operational risk tier despite the ERP-critical nature of the platform.
Technical ContextAI
JD Edwards EnterpriseOne Tools is Oracle's foundational ERP infrastructure layer used for application development, deployment orchestration, and security administration across manufacturing and distribution sectors. The affected component, Enterprise Infrastructure Security, governs authentication and access control within the Tools stack. The exact affected release is version 9.2.26.3, as confirmed by Oracle's July 2026 CPU advisory and EUVD-2026-46761. No CWE has been assigned, meaning Oracle has not publicly disclosed the root cause class; the vulnerability class cannot be precisely determined from available data. The CVSS local attack vector (AV:L) confirms exploitation requires physical or logical presence on the host running EnterpriseOne Tools, ruling out remote network-based attacks. The high attack complexity (AC:H) suggests race conditions, environment-specific dependencies, or timing constraints that make reliable exploitation non-trivial.
RemediationAI
Oracle's July 2026 Critical Patch Update is the primary remediation vehicle - organizations should apply the patches distributed via the CPU at https://www.oracle.com/security-alerts/cpujul2026.html. A specific fixed version number beyond what Oracle delivers through the patch set has not been independently confirmed from the available advisory data, so customers should reference Oracle's patch readme for exact build details. As a compensating control pending patching, administrators should audit and restrict local logon access to JD Edwards EnterpriseOne Tools infrastructure hosts, enforcing least-privilege principles so that only necessary service accounts hold logon rights to these systems. Network segmentation limiting lateral movement to the JD Edwards host layer also reduces attacker opportunity to reach the local access threshold. Monitoring local system events and EnterpriseOne audit logs for anomalous data modification or availability disruptions provides detection capability. No vendor-disclosed workarounds were identified in available references.
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events
The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly
In OpenSSL 1.1.0 before 1.1.0d, if a malicious server supplies bad parameters for a DHE or ECDHE key exchange then this
A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL proto
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, rela
jQuery-UI is the official jQuery user interface library. Rated medium severity (CVSS 6.1), this vulnerability is remotel
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, rela
It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. Rated critical severity (CVS
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, rela
jQuery-UI is the official jQuery user interface library. Rated medium severity (CVSS 6.1), this vulnerability is remotel
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics)
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, rela
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today