EUVD-2026-46870
GHSA-5624-xrqg-pm5v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged EnterpriseOne account
-
DeliveryReach HCM Foundation HTTP endpoint
-
ExploitSend crafted request to OW HR PR Foundation
-
ExecutionTrigger hang/repeatable crash
-
ImpactComplete DoS plus limited data read
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid low-privileged JD Edwards EnterpriseOne account (CVSS PR:L - this is NOT unauthenticated) and network HTTP access to the HCM Foundation / OW HR PR Foundation web tier; no user interaction is needed (UI:N) and attack complexity is low (AC:L, Oracle: 'easily exploitable'). The exact affected feature is the HCM Foundation payroll/HR foundation processing reachable via HTTP in EnterpriseOne 9.2. Limiting factors: only version 9.2 is listed as affected, the attacker must already possess or obtain a low-level authenticated session, and reachability depends on the EnterpriseOne web server being exposed to the attacker's network. The primary realized impact is availability (A:H, full DoS) plus limited confidentiality (C:L); there is no integrity impact (I:N). |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H, base 7.1) indicates a network-reachable, low-complexity attack needing only low privileges and no user interaction, with high availability impact and low confidentiality impact - the dominant risk is a complete DoS of the HCM/payroll system rather than data theft. Oracle's 'easily exploitable' wording aligns with AC:L/PR:L. Key exploitation signals are missing: no EPSS probability was provided, the vulnerability is not in CISA KEV (no confirmed active exploitation), and no public POC is identified - so this is a real-but-not-emergency priority. PR:L means it is not fully unauthenticated; an attacker needs some valid low-level account, which meaningfully limits opportunistic mass exploitation. Priority should be driven by how business-critical the HR/payroll availability is, not by an assumption of imminent internet-wide attack. |
| Exploit ScenarioDerived | An attacker who holds any low-privileged JD Edwards EnterpriseOne account (for example a self-service HR user or a compromised low-level login) sends crafted HTTP requests to the HCM Foundation component over the network. The requests trigger a hang or repeatable crash that takes the HR/payroll application offline (complete DoS) and, in the process, expose a limited subset of accessible data. No public exploit code is currently identified, and given AC:L the technical barrier to reproduce is low once account access is obtained. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 22, 2026
Denial-of-service and information disclosure in Oracle JD Edwards EnterpriseOne HCM Foundation 9.2 (OW HR PR Foundation component) allows a low-privileged, authenticated attacker with network/HTTP access to hang or repeatedly crash the application (complete DoS) and read a subset of accessible data. Oracle rates it CVSS 3.1 7.1 and describes it as 'easily exploitable.' There is no public exploit identified at time of analysis and it is not listed in CISA KEV; no EPSS score was supplied.
RemediationAI
Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (Patch available per vendor advisory: https://www.oracle.com/security-alerts/cpujul2026.html); an exact fixed build/bundle number was not included in the provided data, so obtain the specific HCM Foundation 9.2 patch from that CPU and My Oracle Support. Because Oracle CPUs are the sole supported remediation path and no standalone patched version string was published in the input, no independently confirmed fix version can be cited here - verify the exact patch on the advisory. Until patched, apply compensating controls: restrict network reachability of the EnterpriseOne HTML/web server so only trusted internal networks and VPN users can reach HTTP endpoints (trade-off: may break remote/self-service HR access), tighten and audit low-privilege application accounts to reduce the pool of attackers who satisfy PR:L (trade-off: administrative overhead), and place a WAF/reverse proxy with rate limiting in front of the web tier to blunt the repeatable-crash DoS (trade-off: tuning needed to avoid blocking legitimate payroll traffic). Given the high availability impact, ensure monitoring/alerting on application-tier crashes and have restart/failover runbooks ready.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is Oracle's JD Edwards EnterpriseOne HCM (Human Capital Management) Foundation, part of the JD Edwards ERP suite used for human-resources and payroll processing (the 'OW HR PR Foundation' sub-component points to the HR/Payroll foundation layer). The vulnerability is reachable over HTTP through the EnterpriseOne web/HTML server tier. Oracle did not map a CWE (CWE: N/A), but the observed behavior - a triggerable hang/repeatable crash combined with unauthorized read of a data subset - is consistent with an availability-affecting flaw such as uncontrolled resource consumption or an unhandled condition in request/data handling (CWE-400/CWE-664 class) coupled with an access-control or improper-authorization weakness (CWE-284/CWE-863 class) that exposes limited data. No CPE strings were provided in the input; affected scope is defined by Oracle/EUVD as HCM Foundation 9.2 only.
Know when Jd Edwards Enterpriseone Hcm Foundation gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
Network HTTP and 'easily exploitable' give AV:N/AC:L; a low-level account is required so PR:L; full DoS drives A:H, limited data read C:L, no integrity impact I:N.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the JD Edwards EnterpriseOne HCM Foundation product of Oracle JD Edwards (component: OW HR PR Foundation). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne HCM Foundation. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of JD Edwards EnterpriseOne HCM Foundation and unauthorized read access to a subset of JD Edwards EnterpriseOne HCM Foundation accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H).
Executive ViewAI
Oracle JD Edwards EnterpriseOne HCM Foundation 9.2 contains a high-severity vulnerability that allows authenticated users to completely disable HR operations or access sensitive employee data via network requests. No vendor patch is available, creating immediate operational risk to workforce management and employee information security. Organizations running this product must implement immediate access controls to limit exposure while awaiting a vendor fix.
Until a vendor patch is released: enforce network-based access restrictions limiting HCM Foundation access to authorized personnel only; enable and centralize security logging for all HCM authentication and API calls; implement rate limiting on HCM endpoints to reduce DoS impact if exploitation occurs; conduct periodic access reviews to eliminate unnecessary high-privilege accounts; maintain current backups of HR databases to enable rapid recovery if data access occurs.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB