EUVD-2026-106527
GHSA-3pf4-c778-jmrf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach JD Edwards HTTP endpoint
-
DeliverySend crafted unauthenticated request
-
ExploitExploit Object/Env Tech SEC flaw
-
ExecutionCross scope into linked products
-
ImpactExfiltrate critical business data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires only network reachability to the JD Edwards EnterpriseOne Tools HTTP interface on an affected build (9.2.0.0 through 9.2.26.5); per AV:N/AC:L/PR:N/UI:N there is no authentication, no special configuration, and no user interaction required against default deployments. The practical limiting factor is exposure: the HTTP/web tier of JD Edwards must be reachable by the attacker (e.g., internet-facing or reachable from the attacker's network segment), and the host must be running an unpatched 9.2.x Tools release. The scope change (S:C) means impact can extend to additional products that trust or integrate with the Tools layer, so the realistic blast radius depends on how the JD Edwards environment is interconnected. |
| Impact | This is a genuinely high-priority confidentiality flaw, not merely a high-CVSS paper risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, base 8.6) describes the most dangerous access profile: network-reachable over HTTP, low complexity, no privileges, no user interaction, with a scope change that lets the breach spill into additional products. Oracle's own wording ('Easily exploitable') reinforces the AC:L/PR:N reading. The impact is confidentiality-only - integrity and availability are untouched (I:N/A:N) - so this is a data-exposure issue (unauthorized read of or complete access to all JD Edwards-accessible data), not a destructive or RCE condition despite the elevated score. Several real-world exploitation signals are MISSING from the input: there is no EPSS probability, the CVE is not on CISA KEV, and no POC is referenced, so no public exploit has been identified at the time of analysis. The only reference is Oracle's October 2026 Critical Patch Update advisory; CWE is unassigned (N/A). Net: the technical preconditions make this a strong patch-now candidate for exposed JD Edwards instances, but current evidence points to no known active exploitation rather than widespread in-the-wild attacks - prioritize based on internet exposure and data sensitivity rather than on confirmed exploitation. |
| Exploit ScenarioDerived | An unauthenticated attacker who can reach a JD Edwards EnterpriseOne Tools HTTP endpoint over the network sends a crafted request to the vulnerable Object and Env Tech SEC component and reads critical business data without any credentials or user interaction. Because of the scope change, the attacker's access can extend beyond the Tools layer into additional connected products' data. No public proof-of-concept is referenced, so exploitation would currently require independent development. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 20, 2026
Unauthenticated remote attackers can read critical data from Oracle JD Edwards EnterpriseOne Tools releases 9.2.0.0 through 9.2.26.5 through the component tracked as Object and Env Tech SEC, with the flaw classified as an authentication bypass affecting the HTTP-facing web tier. The CVSS 3.1 score of 8.6 reflects a network-reachable, low-complexity, no-privileges, no-user-interaction attack that is confidentiality-only but carries a scope change, so downstream systems trusting the Tools layer may also be exposed. No public exploit code or confirmed active exploitation was identified at time of analysis, but the exposure-based risk is high where the JD Edwards HTTP interface is internet-facing or reachable from untrusted segments.
RemediationAI
Apply the JD Edwards EnterpriseOne Tools security patch released with the October 2026 Oracle Critical Patch Update (https://www.oracle.com/security-alerts/cpuoct2026.html); because Oracle does not publish a single numeric fix version in the CVE record, confirm the minimum patched Tools release and required one-off/ESU prerequisites against that advisory before upgrading from any 9.2.0.0-9.2.26.5 build. Treat the fix as urgent on any deployment whose HTTP web tier is internet-facing or reachable from lower-trust network segments. Where patching cannot be completed immediately, restrict network access to the EnterpriseOne Tools HTTP listener with firewall ACLs, a VPN gateway, or an authenticating reverse proxy in front of the web tier - accepting that this breaks or complicates legitimate remote and mobile client access and may not be compatible with native EnterpriseOne clients that expect direct HTTP connectivity. Additionally, disable or tightly bind any externally reachable Tools endpoints that are not strictly required, segment the Tools tier from downstream systems that rely on its trust relationships to limit the scope-change blast radius, and enable verbose HTTP access logging plus alerting on anomalous unauthenticated requests to the Object and Environment Tech component so that any exploitation attempts are detected; note that these compensating controls reduce but do not eliminate exposure, since the underlying authorization gap remains until the CPU patch is installed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component, 'Object and Env Tech SEC', is the security layer of Oracle JD Edwards EnterpriseOne Tools' Object and Environment technology - the middleware tier that brokers object management and environment configuration for the EnterpriseOne application stack. The reported issue is tagged as an authentication bypass, and the assessed CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) confirms that access control is not enforced correctly for requests arriving over HTTP, allowing an attacker with only network reachability to reach a state where critical data normally protected by that layer is exposed. No CWE was published by the vendor, but the observable root-cause class is an authorization/authentication enforcement gap in the Tools security component rather than a memory-safety defect: integrity and availability impacts are absent, so the practical effect is bulk disclosure of EnterpriseOne Tools-accessible data. The S:C scope change matters because the Tools layer is frequently trusted by, and federated with, adjacent EnterpriseOne components and integrations, meaning a compromise of confidentiality at that boundary can propagate beyond the single vulnerable product.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
HTTP-reachable, easily exploitable, and unauthenticated per Oracle's description give AV:N/AC:L/PR:N/UI:N; confidentiality-only data access with cross-product impact gives C:H/I:N/A:N and S:C.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Object and Env Tech SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. While the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).
Executive ViewAI
Oracle JD Edwards EnterpriseOne Tools (releases 9.2.0.0 through 9.2.26.5) carries a high-severity authentication bypass in its HTTP-facing Object and Env Tech SEC component that allows a network attacker to read critical data without any credentials or user interaction. The scope-change rating means systems that trust the Tools web tier may be exposed alongside JD Edwards itself, so the blast radius can extend beyond the application into integrated downstream platforms. With no vendor patch yet available and trivial network reachability, leadership should treat any internet-facing or broadly reachable JD Edwards web tier as an open data-exposure risk until containment is in place.
No vendor-released patch identified at time of analysis. Interim mitigations: remove internet exposure of the JD Edwards HTTP tier and restrict access by allow-list at the firewall or load balancer; front affected instances with an authenticating reverse proxy or VPN so the web tier is never reachable anonymously; deploy WAF signatures targeting unauthenticated requests to the Object and Env Tech SEC component; segment JD Edwards from downstream systems that trust the Tools layer to limit scope-change propagation; enable and monitor detailed access and read-audit logging with alerting for anomalous data retrieval; and log an Oracle support request for interim guidance and the target patch release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB