EUVD-2026-106537
GHSA-w9m5-pqc3-cjrv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious HTTP link to Web Runtime SEC
-
ExploitDeliver link to victim user
-
ExecutionVictim interacts and triggers flaw
-
ImpactRead subset of EnterpriseOne data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation targets the Web Runtime SEC component of JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5 over HTTP. It is remote and unauthenticated (PR:N), but is LIMITED by a mandatory user-interaction requirement (UI:R): a person other than the attacker must be induced to interact (e.g., follow a crafted link), so there is no automated or purely server-side exploitation path. Impact is further limited to read access against only a subset of accessible data, with no integrity or availability effect. |
| Impact | This is a genuinely low-priority issue despite being network-exploitable and unauthenticated. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N, base 4.3, MEDIUM) shows the single real signal is low-impact confidentiality disclosure - the attacker gains 'unauthorized read access to a subset' of data, with no integrity or availability impact and no scope change. The critical mitigating factor is UI:R: a victim (someone other than the attacker) must be tricked into interacting, which rules out automated mass exploitation. No KEV listing, no POC, and no EPSS score are present in the input, so there is no evidence of active exploitation or weaponization. One cross-source inconsistency must be flagged: the input Tags include 'Authentication Bypass,' but the Oracle description describes only read access to a data subset requiring user interaction - not any bypass of authentication - so that tag appears inaccurate and should be verified rather than trusted. Overall this is a high-visibility-vendor (Oracle CPU) but low-real-risk vulnerability. |
| Exploit ScenarioDerived | An attacker crafts a malicious HTTP link or request targeting the JD Edwards EnterpriseOne Tools Web Runtime SEC component and lures an authenticated or legitimate user into clicking it. Because successful attacks require human interaction (UI:R), the victim's interaction triggers disclosure of a limited subset of EnterpriseOne data back to the attacker. No public exploit identified at time of analysis, and only confidentiality is affected. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Unauthenticated HTTP traffic against Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 can leak a limited subset of application data through the Web Runtime SEC component, but only if a victim is first persuaded to interact with attacker-controlled content (UI:R), so there is no self-contained server-side exploitation path. CVSS 3.1 scores it 4.3 with confidentiality-only impact (C:L) and no effect on integrity or availability. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, and it is rated a genuinely low-priority issue despite the network-reachable, unauthenticated vector. Oracle addresses it in the October 2026 Critical Patch Update.
RemediationAI
Apply the Oracle Critical Patch Update for October 2026 (https://www.oracle.com/security-alerts/cpuoct2026.html), which is the vendor-released remediation for this issue; the specific minimum patched Tools release level is not stated in the available data, so confirm the target version against the CPU's patch availability matrix before upgrading both the EnterpriseOne Tools web runtime and any dependent HTML/web servers in the stack. Because the attack requires a victim to interact with attacker-supplied content, the most effective compensating control while patching is to reduce the reachable attack surface: restrict HTTP access to the Web Runtime SEC endpoints to trusted networks or VPN, and place the web tier behind a reverse proxy that enforces authentication and normalizes or rejects malformed request URIs - the trade-off is reduced accessibility for remote or partner users and possible breakage of legitimate deep-link or bookmark URLs. Complement this with user-facing controls, since UI:R is the primary barrier: keep browser and mail filtering aggressive against unfamiliar links pointing at the EnterpriseOne hostname, and brief users on not following unsolicited links into ERP sessions; the trade-off is operational friction and imperfect human compliance. Internet-exposed EnterpriseOne web tiers that do not require external access should be closed at the firewall entirely, and monitoring should focus on anomalous read patterns from sessions whose referrer or navigation path indicates crafted-link entry, since integrity and availability impacts are absent and volume-based detections will otherwise miss the low-and-slow read behavior.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw sits in the Web Runtime SEC component of JD Edwards EnterpriseOne Tools, the HTTP-facing layer that serves the ERP web client, so exploitation is conducted over standard HTTP requests rather than through a database or protocol-level primitive. The CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N describes an attack that needs no credentials and no special conditions, yet is gated by mandatory interaction from a person other than the attacker - typically following a crafted link or loading attacker-influenced content in a browser session that already holds or can reach EnterpriseOne data. Because scope is unchanged and only confidentiality is touched at the Low level, the disclosure is bounded to a subset of data the victim's context can already access rather than a full authentication bypass or data-store compromise. No CWE was supplied by the vendor, but the accompanying 'Authentication Bypass' tag combined with the Web Runtime SEC designation points to a weakness in how the runtime validates or associates a request with an authenticated session or authorization context; the practical consequence, however, remains constrained informational exposure rather than account takeover.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Remote HTTP vector with no privileges (PR:N) but required victim interaction (UI:R); only a limited data subset is read, so C:L and I/A:N.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N).
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB