EUVD-2026-106358
GHSA-48mv-hffj-jf8m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged logon to EnterpriseOne host
-
DeliveryAccess Enterprise Infrastructure SEC component
-
ExploitExploit local flaw (AC:L)
-
ExecutionEscalate to full compromise
-
ImpactComplete takeover of EnterpriseOne Tools
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already possess an authenticated low-privilege logon (PR:L) on the infrastructure host where JD Edwards EnterpriseOne Tools executes - this is a local attack (AV:L), not remotely reachable over the network, which is the primary limiting factor. The affected scope is the Enterprise Infrastructure SEC component on EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5. No user interaction is needed (UI:N) and complexity is low (AC:L), so once local access exists the attack is reliable; the key defender takeaway is that local account access to the EnterpriseOne server is the gating prerequisite. |
| Impact | The CVSS 3.1 base score of 7.8 (High) is driven entirely by the impact metrics (C:H/I:H/A:H) rather than easy reachability. The vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U is a local-access profile: the attacker must already have a logon to the infrastructure where JD Edwards EnterpriseOne Tools executes and hold low-level privileges (PR:L). This substantially constrains real-world risk versus a network-exploitable flaw - it is a privilege-escalation / host-takeover primitive available to an already-authenticated local user, not a remote-unauthenticated breach. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so exploitation probability cannot be quantified and there is no public exploit identified at time of analysis. The signals are internally consistent (description's 'low privileged attacker with logon to the infrastructure' matches PR:L and AV:L), with no network-vs-local conflict to flag. Net: a genuinely serious post-authentication takeover issue that should be patched via Oracle's October 2026 CPU, but its priority relative to internet-facing critical bugs is lowered by the local-access precondition and the absence of any exploitation-maturity evidence (EPSS/KEV/POC all absent). |
| Exploit ScenarioDerived | An attacker who already holds a low-privileged local account on the server (or infrastructure host) running JD Edwards EnterpriseOne Tools abuses a flaw in the Enterprise Infrastructure SEC component to escalate to full control of the EnterpriseOne Tools instance. Because attack complexity is low (AC:L) and no user interaction is required (UI:N), a successful local user can reliably trigger it. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Takeover of Oracle JD Edwards EnterpriseOne Tools (Enterprise Infrastructure SEC component) is possible for an attacker who already holds a low-privileged authenticated logon on the host running the product, affecting versions 9.2.0.0 through 9.2.26.5. The flaw is local rather than network-reachable (AV:L), needs no user interaction, and has low attack complexity, so once the prerequisite account access exists the attacker can reliably gain high confidentiality, integrity, and availability impact, yielding a CVSS 3.1 base score of 7.8. No public exploit code or confirmed active exploitation was identified at time of analysis, and the practical gating factor is possession of local credentials on the EnterpriseOne server tier.
RemediationAI
Apply the fix from Oracle's October 2026 Critical Patch Update advisory (https://www.oracle.com/security-alerts/cpuoct2026.html); Oracle released the correction for EnterpriseOne Tools 9.2.0.0 through 9.2.26.5, and patched versions are available per that vendor advisory ('vendor-released patch' at the advisory level; the specific patched build number should be confirmed from the CPU page before deployment). Where immediate patching is not feasible, the effective compensating control is shrinking the local attack surface: restrict interactive logon (console, SSH, RDP) to the EnterpriseOne application servers to a small named administrator group, since a low-privileged authenticated local account is the sole prerequisite - the trade-off is reduced operational convenience for support staff, who can be routed through a jump host with session logging instead. Audit and prune unnecessary OS and application accounts on the EnterpriseOne tier and remove excess privileges from service and support accounts, since PR:L is what the exploit needs. Additionally, monitor the EnterpriseOne and host logs for unexpected privilege changes or SEC-component configuration edits, and segment the EnterpriseOne server subnet so that a compromised low-privilege account cannot easily reach adjacent systems; segmentation adds network complexity but meaningfully reduces blast radius. Retire the 9.2.0.0-9.2.26.5 releases in favor of a vendor-supported level as part of normal lifecycle management.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue resides in the Enterprise Infrastructure SEC component of JD Edwards EnterpriseOne Tools, the layer that handles security infrastructure functions such as authentication, authorization, and session/credential handling for the EnterpriseOne application stack. The provider did not assign a CWE, but the CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is the classic signature of a local privilege-escalation or insecure-permission condition: a low-privileged but already authenticated principal can, without user interaction, escalate to full control of the product's own security context and thereby its confidentiality, integrity, and availability. Because the scope is unchanged (S:U), the compromise is contained to the EnterpriseOne Tools security subsystem rather than automatically pivoting to other components. The local attack vector means the flaw is not reachable over the network from an unauthenticated position, which materially limits exposure compared with a remote pre-auth issue; the underlying technology is a Java-based enterprise ERP middleware tier typically deployed on application servers with OS-level accounts, and the SEC component's configuration and file/process permissions are the likely surface for this escalation path.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Description states low-privileged attacker with logon to the executing infrastructure, so AV:L and PR:L; low complexity and full takeover yield AC:L and C:H/I:H/A:H.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
A high-severity local privilege-escalation flaw in Oracle JD Edwards EnterpriseOne Tools (Enterprise Infrastructure SEC component) affects every release from 9.2.0.0 through 9.2.26.5, allowing anyone who already holds a low-privileged account on an EnterpriseOne server to escalate to full control of confidentiality, integrity, and availability on that host. Because the ERP platform typically underpins financial close, supply chain, and order-to-cash processes, a compromised application tier could expose or corrupt core business records even though no public exploit or active campaign has been observed. Leadership should treat this as a contained but material risk concentrated in the server tier and driven primarily by the breadth of unpatched versions in the estate rather than by external attack exposure.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict and continuously review local and EnterpriseOne account entitlement on the server tier, enforce least privilege and remove shared or generic credentials, rotate credentials for accounts with access to the SEC component, segment the EnterpriseOne application tier so it cannot be reached using reusable low-privilege credentials from lower-trust networks, monitor and alert on local privilege changes and administrative SEC operations, and apply the Oracle fix as soon as a corrected version above 9.2.26.5 is published.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB