EUVD-2026-106422
GHSA-v7m2-vhg5-c24v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged EnterpriseOne credentials
-
ExploitConnect to JDENET network service
-
ExecutionSend crafted request abusing Business Logic Infra SEC
-
ImpactPerform unauthorized read and update/insert/delete of data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the JDENET service of JD Edwards EnterpriseOne Tools and a valid low-privileged authenticated account (CVSS PR:L) on an affected version (9.2.0.0 through 9.2.26.5); no user interaction is needed (UI:N). The primary limiting factors are the authentication requirement - the attacker must already possess or obtain legitimate low-privilege JD Edwards credentials - and network exposure of the JDENET interface, which in well-segmented deployments is not internet-facing. Impact is further bounded to a subset of accessible data (partial read and partial write), with no availability effect. |
| Impact | This is a moderate-severity (CVSS 3.1 base 5.4) authenticated data-access flaw in Oracle JD Edwards EnterpriseOne Tools, not a top-tier emergency. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms a network-reachable, low-complexity attack but requires an authenticated low-privileged account (PR:L), which meaningfully constrains the attacker population to users who already have some JD Edwards access. Impact is partial: limited unauthorized read (C:L) plus limited update/insert/delete (I:L), with no availability impact (A:N) and no scope change (S:U). No EPSS score was supplied, the CVE is not in CISA KEV, and no public POC was referenced, so there is no evidence of active exploitation or weaponization - risk is driven by the theoretical attack surface, not demonstrated threat activity. One signal conflict must be flagged: the input Tags include 'Authentication Bypass,' but the CVSS vector and Oracle description describe a flaw exploited BY a low-privileged authenticated attacker (PR:L), i.e., privilege/data-access abuse, not an authentication bypass - treat the tag as unreliable. Overall this warrants routine patching in the Oracle October 2026 CPU cycle rather than emergency out-of-band response, with higher priority for environments that grant broad low-privilege JDENET access. |
| Exploit ScenarioDerived | An attacker who holds or phishes a low-privileged JD Edwards EnterpriseOne user account connects over the network to the JDENET service and sends a crafted request that abuses the Business Logic Infra SEC component. This yields unauthorized read of a subset of EnterpriseOne data and unauthorized insert/update/delete of some accessible data. No public exploit code was identified at time of analysis, and no user interaction is required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Low-privileged users of Oracle JD Edwards EnterpriseOne Tools can read and modify data beyond their authorized scope through the JDENET interface, affecting versions 9.2.0.0 through 9.2.26.5. The flaw sits in the Business Logic Infra SEC component and requires only a valid low-privilege account plus network reachability to JDENET (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, base 5.4), with no user interaction; impact is bounded to partial confidentiality and integrity loss with no availability effect. The available intelligence contains no confirmed active exploitation (not in CISA KEV) and no public exploit code, so practical risk concentrates on deployments where the JDENET listener is broadly reachable and low-privilege accounts are loosely provisioned or shared.
RemediationAI
Apply the fix released in Oracle's October 2026 Critical Patch Update, whose advisory (https://www.oracle.com/security-alerts/cpuoct2026.html) lists the patched JD Edwards EnterpriseOne Tools build for the 9.2 line; the exact remediated version number is not stated in the available data, so confirm it against the advisory's affected-products table before upgrading, and note that Oracle CPU patches for EnterpriseOne typically require applying the EnterpriseOne Tools patch plus any dependent JDENET/security-layer updates and a restart of the logic servers. Patch status per the available data is 'Patch available per vendor advisory'; no vendor-released version string is confirmed here. Until patched, the highest-value compensating control is network-level restriction of the JDENET listener so that only trusted application tiers, logic servers, and approved client subnets can reach it - the trade-off is that overly tight filtering breaks distributed logic-server communication, batch integrations, and remote fat-client access, so validate against the deployment topology first. In parallel, audit and trim low-privilege JD Edwards accounts (the vector requires only PR:L), remove or rotate shared and service credentials, and alert on JDENET sessions issuing writes outside the account's normal role footprint; revoking or tightly scoping these accounts may disrupt integrations that reuse them, so map dependencies beforehand. Because JDENET traffic is proprietary and typically unlogged at the application layer, enable verbose security-layer and JDENET logging during the exposure window at the cost of additional log volume and some performance overhead.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle JD Edwards EnterpriseOne is an ERP suite whose components communicate over JDENET, Oracle's proprietary messaging and middleware layer that connects thick/thin clients, logic servers, and batch processes. This issue is attributed to the 'Business Logic Infra SEC' component, the security/business-logic layer that enforces authorization decisions for JDENET-mediated operations, and the supplied tag 'Authentication Bypass' together with the PR:L vector indicates an access-control enforcement gap rather than a memory-safety bug: an attacker holding any valid low-privilege JD Edwards account can drive JDENET calls that the component fails to check against the caller's role, yielding unauthorized insert/update/delete plus read access to a subset of application data. No CWE identifier was provided, so the root-cause class is inferred from the vector and tag (an authorization/access-control weakness in the CWE-863 family) rather than confirmed; the unchanged scope (S:U) and low attack complexity (AC:L) mean the flaw does not, by itself, escalate beyond the EnterpriseOne security context, but it does erode the role separation the ERP's security model depends on. Because JDENET is an internal application protocol, exposure is a function of network segmentation rather than internet-facing web tier hardening.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Network-facing JDENET with low complexity (AV:N/AC:L), but a low-privileged authenticated account is required (PR:L); partial read and write impact (C:L/I:L), no availability or scope change.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Business Logic Infra SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data as well as unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB