EUVD-2026-106357
GHSA-hvr9-crcm-36vj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed JD Edwards HTTP endpoint
-
ExploitSend crafted unauthenticated request
-
ExecutionBypass SEC authentication controls
-
ImpactCreate, delete or modify critical data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitable only against JD Edwards EnterpriseOne Tools releases 9.2.0.0 through 9.2.26.5 whose HTTP interface (the Enterprise Infrastructure SEC / security layer) is reachable by the attacker over the network; per CVSS PR:N/UI:N no authentication or user interaction is required. The primary limiting factor is network exposure of the EnterpriseOne Tools HTTP service - instances restricted to internal networks or behind access controls materially reduce reachable attack surface - and the impact is bounded to integrity (unauthorized data creation/deletion/modification), with no confidentiality or availability loss per the vector. |
| Impact | The vendor-supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, base 7.5) indicates a remotely reachable, low-complexity flaw requiring no privileges or user interaction, with high integrity impact but no confidentiality or availability impact - a classic unauthenticated data-tampering issue consistent with the 'Enterprise Infrastructure SEC' component and the 'Authentication Bypass' tag. Oracle explicitly labels it 'easily exploitable,' which aligns with AC:L and PR:N. However, no EPSS probability, no CISA KEV listing, and no public POC are present in the supplied data, so predicted and observed exploitation signals are absent and cannot be weighed against the high CVSS. This should be treated as a genuine high-priority patch item for exposed JD Edwards EnterpriseOne Tools instances given the unauthenticated network vector, but there is no evidence of active or at-scale exploitation yet; the integrity-only impact (no confidentiality/availability loss) somewhat narrows the real-world consequence to unauthorized data creation/deletion/modification rather than full compromise or outage. No signals are directly conflicting, but the exploitation-likelihood dimension is simply missing from the input. |
| Exploit ScenarioDerived | An attacker with network access to an internet- or intranet-exposed JD Edwards EnterpriseOne Tools HTTP endpoint sends crafted requests that bypass authentication controls in the Enterprise Infrastructure SEC component, then creates, deletes, or modifies critical business data without valid credentials. No public exploit code is identified in the provided data, and the attack requires no user interaction or elevated privileges per the CVSS vector. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Unauthenticated remote attackers with HTTP access to the Enterprise Infrastructure SEC component of Oracle JD Edwards EnterpriseOne Tools (releases 9.2.0.0 through 9.2.26.5) can tamper with application data, based on the vendor's CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, base 7.5). The flaw is scored for high integrity impact only - attackers cannot read confidential data or disrupt availability - but no privileges or user interaction are required, making the integrity of EnterpriseOne business records the sole but significant exposure. No public exploit code or confirmed active exploitation was identified at time of analysis, and the primary practical limit on exposure is whether the EnterpriseOne Tools HTTP interface is reachable from untrusted networks.
RemediationAI
Oracle addresses this in the October 2026 Critical Patch Update; consult https://www.oracle.com/security-alerts/cpuoct2026.html for the exact patched EnterpriseOne Tools release level applicable to your deployment and apply the CPU (or the corresponding JD Edwards Electronic Software Update bundle) to move off the 9.2.0.0-9.2.26.5 range - patch status is best described as available per vendor advisory, since no specific fixed build number is published in the source data. Because the attack path is the Enterprise Infrastructure SEC HTTP interface, immediate compensating controls are: restrict inbound HTTP/HTTPS access to EnterpriseOne Tools services to trusted networks and reverse proxies only (side effect: remote and partner users must go through VPN or an application gateway), place the AIS/web servers behind a WAF with rules blocking unauthenticated requests to security-infrastructure endpoints (side effect: possible false positives on legitimate SSO/session traffic requiring tuning), and disable or firewall any EnterpriseOne Tools HTTP listeners that are not strictly required (side effect: loss of functionality for integrations depending on those endpoints). Monitor web server and EnterpriseOne security logs for unauthenticated requests that result in data writes, and treat unexpected record creation, modification or deletion in business tables as a potential compromise indicator.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability sits in Oracle JD Edwards EnterpriseOne Tools, specifically the Enterprise Infrastructure SEC (security infrastructure) component, which implements the HTTP-facing session, authentication and authorization layer used by EnterpriseOne web clients, AIS server and related services. The reporting tags classify the issue as an Authentication Bypass, meaning the security layer fails to properly enforce identity or authorization checks on requests, so an unauthenticated network client can reach functionality intended to be gated. No CWE identifier was supplied, and the vendor provides no root-cause detail beyond the component name, so the exact defect (for example a missing authorization check, an improperly validated session/token, or an unprotected administrative endpoint) cannot be confirmed from available data. What the CVSS vector does establish is the attack profile: network vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and a purely integrity-oriented impact (C:N/I:H/A:N) - the signature of an unauthenticated data-modification path rather than a confidentiality breach or denial of service. No CPE strings were included in the intelligence feed; the only confirmed version boundary comes from the vendor and ENISA EUVD, both of which scope the issue to EnterpriseOne Tools 9.2.0.0 through 9.2.26.5.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Unauthenticated HTTP-reachable auth bypass gives AV:N/AC:L/PR:N/UI:N; impact is data tampering only, so I:H with C:N and A:N.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).
Executive ViewAI
Oracle JD Edwards EnterpriseOne Tools releases 9.2.0.0 through 9.2.26.5 contain a high-severity flaw in the Enterprise Infrastructure SEC component that allows unauthenticated attackers with HTTP access to tamper with application data. The primary organizational risk is corruption or manipulation of business records, which could lead to financial misstatement, fraud, or compliance failures for finance and operations teams relying on EnterpriseOne. No public exploit identified at time of analysis, but with no vendor-released patch and an unauthenticated attack path, immediate exposure reduction is warranted.
No vendor-released patch identified at time of analysis; restrict HTTP access to the Enterprise Infrastructure SEC component to trusted networks, enforce network segmentation, deploy WAF rules to block anomalous requests, and monitor application data integrity for unauthorized changes.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB