EUVD-2026-46868
GHSA-87xq-p5fv-rq22
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network HTTP reach and low complexity per Oracle, PR:L because a valid low-privilege account is required, and full takeover justifies C:H/I:H/A:H with unchanged scope.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the JD Edwards EnterpriseOne CRM Foundation product of Oracle JD Edwards (component: CRM Foundation). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne CRM Foundation. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne CRM Foundation. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
AnalysisAI
Full compromise of Oracle JD Edwards EnterpriseOne CRM Foundation 9.2 is possible by a low-privileged, network-based attacker over HTTP, with Oracle rating the flaw "easily exploitable" and assigning a CVSS 3.1 base score of 8.8 spanning confidentiality, integrity, and availability. An authenticated user holding only minimal privileges can escalate to a complete takeover of the CRM Foundation component, gaining read/write access to CRM data and the ability to disrupt the service. There is no public exploit identified at time of analysis and the CVE is not in CISA KEV; the issue is addressed in Oracle's July 2026 Critical Patch Update.
Technical ContextAI
JD Edwards EnterpriseOne is Oracle's ERP suite, and the affected CRM Foundation component provides the shared customer-relationship-management services (customer, contact, and sales foundation data) consumed by higher-level JDE CRM modules. The exposure is reached through the product's HTTP/web tier (the EnterpriseOne HTML/JAS web server front end), which is why the vector is network-based. No CWE was supplied by the source, so the precise weakness class (e.g., access-control bypass, injection, or deserialization) cannot be stated with certainty; Oracle's advisory tag of "Information Disclosure" combined with a full C/I/A takeover impact suggests an authorization/access-control failure that lets a low-privileged session act beyond its intended scope. No CPE strings were provided in the intelligence, so exact configuration identifiers must be taken from Oracle's affected-version list (9.2) rather than an NVD CPE match.
RemediationAI
Apply the fixes from Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html); this is the authoritative source for the exact patch/bundle level for JD Edwards EnterpriseOne Tools and CRM Foundation, and because no standalone fixed version number was provided in the intelligence, treat this as "Patch available per vendor advisory" and consult the CPU for the precise Tools release. Because exploitation requires an authenticated low-privileged session, compensating controls until patching completes include restricting network access to the EnterpriseOne HTML/JAS web tier to trusted internal networks or VPN rather than exposing it to the internet, tightening Security Workbench role permissions so low-privilege accounts cannot reach CRM Foundation functions, enforcing strong authentication and disabling unused or default accounts, and increasing monitoring of CRM Foundation transactions for anomalous access; note that access restrictions may inconvenience remote or partner users and permission tightening should be validated against legitimate business workflows before enforcement.
Full product takeover in Oracle JD Edwards EnterpriseOne CRM Foundation 9.2 lets an authenticated low-privileged attacke
Full compromise of Oracle JD Edwards EnterpriseOne CRM Foundation 9.2 is possible when a low-privileged attacker with ne
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today