EUVD-2026-46872
GHSA-h9xp-5cm9-vrj9
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
Unauthenticated network HTTP reach (AV:N/PR:N/UI:N) but Oracle-stated difficult exploitation (AC:H); availability dominates (A:H) with only partial data read/write (C:L/I:L).
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the JD Edwards EnterpriseOne General Ledger product of Oracle JD Edwards (component: E1 Foundation). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne General Ledger. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of JD Edwards EnterpriseOne General Ledger as well as unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne General Ledger accessible data and unauthorized read access to a subset of JD Edwards EnterpriseOne General Ledger accessible data. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H).
AnalysisAI
Denial-of-service and partial data tampering in Oracle JD Edwards EnterpriseOne General Ledger 9.2 (E1 Foundation component) lets a remote, unauthenticated attacker reach the application over HTTP to cause a complete hang or repeatable crash, plus limited unauthorized read and write access to General Ledger data. The CVSS 3.1 base score is 7.0 with high attack complexity, meaning exploitation is possible without credentials but not trivially repeatable. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score supplied in the input.
Technical ContextAI
JD Edwards EnterpriseOne is Oracle's ERP suite; the affected General Ledger module handles core financial posting and accounting data, and the flaw resides in the E1 Foundation component that underpins the HTML/web server tier reachable over HTTP. Oracle's advisory does not assign a CWE (input shows CWE: N/A), so the precise root-cause weakness class is not disclosed, but the combination of a repeatable crash (high availability impact) with limited read and write access suggests a request-handling or input-validation defect in the Foundation layer that mishandles crafted HTTP traffic. The mixed impact profile (C:L/I:L/A:H) indicates the underlying defect primarily degrades availability while incidentally exposing and mutating a subset of accessible data rather than granting full compromise.
RemediationAI
Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html); this is the primary and vendor-supported remediation - patch available per vendor advisory, though the input does not name a specific patched build number so confirm the exact JD Edwards Tools/Applications release level against the CPU matrix. Because the flaw is reachable over HTTP without authentication, until patching is complete restrict network exposure of the JD Edwards HTML/web server: place it behind a VPN or reverse proxy, limit inbound HTTP access to trusted corporate ranges via firewall or WAF rules, and monitor for anomalous requests causing repeated application hangs or crashes - with the trade-off that tightening ingress may disrupt legitimate remote or integration clients that reach the General Ledger endpoints. Do not rely on authentication as a control here, since exploitation requires none.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today