EUVD-2026-106347
GHSA-7xhv-m3fc-2grw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged JDENET network access
-
ExploitSend crafted request to Interoperability SEC
-
ExecutionBypass authorization checks
-
ImpactRead/modify or delete critical EnterpriseOne data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the JDENET communication service of JD Edwards EnterpriseOne Tools and the Interoperability SEC component, plus valid low-privileged credentials (CVSS PR:L) - it is not a pre-authentication attack despite the 'Authentication Bypass' tag. Affected versions are 9.2.0.0 through 9.2.26.5. No user interaction is needed (UI:N) and complexity is low (AC:L). Limiting factors: the attacker must first possess an authenticated account on the EnterpriseOne environment, and JDENET must be network-accessible to the attacker; environments that restrict JDENET exposure and tightly control account provisioning materially reduce realistic risk. |
| Impact | This is a credible high-priority patch target but not a confirmed emergency. The CVSS 3.1 base score is 8.1 with vector AV:N/AC:L/PR:L/UI:N - network-reachable over the JDENET protocol, low attack complexity, and only low-level privileges required, which Oracle characterizes as 'easily exploitable.' Impact is high to confidentiality and integrity (C:H/I:H) with no availability impact (A:N), consistent with unauthorized read and create/delete/modify of critical or all accessible data. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active or imminent exploitation - exploitation status is 'no public exploit identified at time of analysis.' The one notable conflict: the input Tags include 'Authentication Bypass,' yet the CVSS vector specifies PR:L (a low-privileged, authenticated attacker), so this is privilege abuse by an authenticated actor rather than a true pre-auth bypass - verify with the Oracle CPU advisory before treating it as unauthenticated. Net: a strong candidate for prioritized patching in the October 2026 Oracle CPU cycle, but current real-world exploitation risk is unproven. |
| Exploit ScenarioDerived | An attacker who already holds low-privileged credentials on a JD Edwards EnterpriseOne Tools environment sends crafted traffic to the network-exposed JDENET service, abusing a flaw in the Interoperability SEC component to read and alter critical business data beyond their authorization level. No user interaction is required and attack complexity is low. No public exploit code is identified at the time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Oracle JD Edwards EnterpriseOne Tools (Interoperability SEC) versions 9.2.0.0 through 9.2.26.5 allows a low-privileged authenticated attacker with network access to JDENET to create, delete, or modify critical data and read all data accessible to the application. The CVSS 3.1 score is 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N); no public exploit code or CISA KEV confirmation was identified at time of analysis. Despite an 'Authentication Bypass' tag, the assessed vector requires valid low-privileged credentials, making this a credible high-priority patch target but not a confirmed emergency.
RemediationAI
Apply the JD Edwards EnterpriseOne Tools patch from Oracle's October 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpuoct2026.html; the supplied data does not identify an exact fixed version, so verify the minimum fixed release in the advisory before closing. Until patched, restrict network access to JDENET to known application and integration hosts using firewall rules or network segmentation, accepting that this can break legitimate integrations and remote clients. Enforce least privilege on EnterpriseOne accounts and review low-privileged users with Interoperability access, which limits blast radius but may require role cleanup. Monitor JDENET traffic and application audit logs for anomalous create, delete, or modify operations, recognizing that this is detective only and does not prevent exploitation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is Interoperability SEC within Oracle JD Edwards EnterpriseOne Tools, reached over JDENET. JDENET is the proprietary network service used for communications among EnterpriseOne components and clients, so exposing it beyond trusted integration networks increases attack surface. Oracle did not assign a CWE in the supplied data, and the precise programming flaw is undisclosed. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) indicates an authenticated, low-complexity network attack with no user interaction that compromises confidentiality and integrity but not availability; this aligns with the independent assessment that valid low-privileged credentials are required and that the 'Authentication Bypass' tag should not be read as pre-auth exploitation.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Network-exposed JDENET service (AV:N) with low complexity and an authenticated low-privileged account (PR:L); high confidentiality and integrity impact, no availability impact (A:N).
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
Executive ViewAI
Oracle JD Edwards EnterpriseOne Tools, versions 9.2.0.0 through 9.2.26.5, carries a high-severity exposure that could allow a low-privileged authenticated user with JDENET network access to compromise the integrity and confidentiality of ERP records. For leadership, the concern is that finance, supply-chain, and operational data could be altered or exposed, affecting reporting, transaction processing, and regulatory confidence. No public exploit identified at time of analysis, so this should be treated as a priority remediation item rather than an immediate crisis.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting network access to JDENET to trusted hosts, enforcing least privilege and reviewing low-privileged accounts, segmenting affected JD Edwards EnterpriseOne Tools deployments, enabling and monitoring detailed logging for data changes and JDENET activity, and alerting on unusual create, delete, or modify actions. Apply vendor patch when released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB