EUVD-2026-106532
GHSA-8c52-6vqr-crmm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged logon on JDE host
-
ExploitAccess Monitoring and Diagnostics SEC component
-
ExecutionAbuse flaw to read protected data
-
ImpactExfiltrate critical application data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already possess a low-privileged account with interactive logon to the infrastructure/host where JD Edwards EnterpriseOne Tools executes (AV:L, PR:L), and to interact with the Monitoring and Diagnostics (SEC) component on affected Tools versions 9.2.0.0 through 9.2.26.5. No user interaction is needed (UI:N) and complexity is low (AC:L). The key limiting factors are the local attack vector (no remote/network exploitation) and the pre-existing authenticated foothold required - this cannot be triggered by an unauthenticated or purely remote attacker, confining realistic risk to insiders or attackers who have already breached a low-tier account. |
| Impact | This is a moderate-severity, low-urgency issue despite the 'Authentication Bypass' tag, which the data does not support. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) describes a LOCAL-access, LOW-complexity flaw requiring EXISTING low-level privileges (PR:L) - the attacker must already have logon access to the infrastructure running JD Edwards EnterpriseOne Tools. Impact is confidentiality-only (C:H), with no integrity or availability effect, so this is pure unauthorized data disclosure, not code execution or takeover. No EPSS score, CISA KEV listing, POC reference, or SSVC decision data was supplied, so exploitation probability cannot be quantified from the input; exploitation status is 'no public exploit identified at time of analysis.' The local vector plus required privileges sharply limits real-world exposure - this is not internet-facing mass-exploitation material. Notably, the 'Authentication Bypass' tag CONFLICTS with the CVSS data: an authentication bypass would imply PR:N, but the vector states PR:L and the description explicitly requires a logged-on low-privileged user, so the tag appears mislabeled and should not drive prioritization. |
| Exploit ScenarioDerived | An attacker who already holds a low-privileged account on the server where JD Edwards EnterpriseOne Tools runs abuses the Monitoring and Diagnostics (SEC) component to read sensitive data they should not be able to access, up to all data reachable by the application. No user interaction is needed, but local logon access is a prerequisite. No public exploit code was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Low-privileged local users can read critical data from JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 via the Monitoring and Diagnostics SEC component, according to the Oracle October 2026 CPU. The assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) requires an existing interactive logon on the host running the affected Tools, so this is not a remote or unauthenticated authentication bypass despite the supplied 'Authentication Bypass' tag. No public exploit identified at time of analysis, and no CISA KEV entry is present in the provided data.
RemediationAI
Patch available per vendor advisory: apply the Oracle Critical Patch Update (October 2026) for JD Edwards EnterpriseOne Tools using the guidance at https://www.oracle.com/security-alerts/cpuoct2026.html; the provided data does not specify an exact fixed build, so confirm the corrected 9.2.x Tools level in the CPU before rollout. If patching must be deferred, restrict interactive logon to the host running JD Edwards EnterpriseOne Tools to trusted administrators and tightly limit low-privileged accounts, accepting reduced operational flexibility; audit and monitor access to the Monitoring and Diagnostics SEC component for unexpected data reads, with the trade-off of added logging overhead; and enforce least privilege for any account that can reach that component. No public exploit identified at time of analysis and no CISA KEV entry is present, so emergency out-of-band action is not indicated by the supplied data, but standard CPU cadence should be maintained.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle JD Edwards EnterpriseOne Tools is the tooling layer for Oracle's JD Edwards EnterpriseOne ERP environment, and the affected Monitoring and Diagnostics SEC component is the security-related diagnostics surface referenced by the CPU. The data provides no CWE or CPE strings and an EUVD range of 9.2.0.0 through 9.2.26.5. The assessed CVSS vector is local (AV:L), low-complexity (AC:L), low-privileged (PR:L), no user interaction (UI:N), unchanged scope, with high confidentiality impact but no integrity or availability impact; that pattern points to a confidentiality-only exposure reachable by an already-authenticated local user rather than a pre-authentication bypass. The supplied 'Authentication Bypass' tag should therefore be treated as low-confidence and not as evidence of unauthenticated access.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local logon with existing low privileges gives AV:L/PR:L/AC:L; confidentiality-only data disclosure sets C:H with I:N and A:N, scope unchanged.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB