EUVD-2026-106584
GHSA-wq9f-29rp-9f8h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged logon to host
-
ExploitAccess Installation Security component
-
ExecutionTrigger availability flaw
-
ImpactCause partial denial of service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Resource release
|
| Exploitation Conditions | Exploitation requires the attacker to already hold a low-privileged logon (PR:L) on the infrastructure where JD Edwards EnterpriseOne Tools executes, targeting the Installation Security component; the vector is local (AV:L), so remote or unauthenticated exploitation is not possible from the provided CVSS data. No user interaction is needed (UI:N) and attack complexity is low (AC:L), but the impact is limited to a partial denial of service (A:L) with no confidentiality or integrity effect. The authentication requirement and local-only access are the primary limiting factors; affected versions are 9.2.0.0 through 9.2.26.5, and the Oracle October 2026 CPU provides the fix. |
| Impact | This is a genuinely low-priority issue, and the available signals are internally consistent rather than conflicting. The Oracle-assigned CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L, base 3.3) describes a locally-accessible, low-complexity attack requiring an already-authenticated low-privileged account (PR:L) and yielding only a partial availability impact (A:L) with no confidentiality or integrity effect. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no public exploit identified at time of analysis. The 'easily exploitable' phrasing in Oracle's description aligns with AC:L but is constrained by the local-vector and authentication prerequisites, so it does not elevate real-world risk. Bottom line: a legitimately low-severity, local, authenticated partial-DoS - not a widespread remote-exploitation threat. EPSS data is absent, so exploitation probability cannot be quantified; however, the low impact and local/authenticated prerequisites make meaningful real-world exploitation unlikely. |
| Exploit ScenarioDerived | A user with a valid low-privileged account on the host where JD Edwards EnterpriseOne Tools runs leverages a flaw in the Installation Security component to disrupt part of the application's availability. No public exploit code is identified, and the attack is bounded to a partial denial of service without data exposure or modification. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Partial denial of service in Oracle JD Edwards EnterpriseOne Tools (Installation Security component) affects versions 9.2.0.0 through 9.2.26.5 and requires an attacker who already holds a low-privileged logon on the infrastructure where the product executes. Successful exploitation degrades availability only - confidentiality and integrity are unaffected - and because the vector is local (AV:L) with low attack complexity (AC:L) and no user interaction (UI:N), the CVSS 3.1 base score stays at 3.3. No public exploit identified at time of analysis, there is no CISA KEV entry, and no EPSS score was supplied; the Oracle October 2026 Critical Patch Update provides the fix.
RemediationAI
Apply the Oracle October 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpuoct2026.html), which Oracle identifies as containing the fix for this issue; organizations running 9.2.0.0 through 9.2.26.5 should move to a CPU level above 9.2.26.5, prioritizing internet-exposed or multi-tenant hosts where many low-privileged accounts exist. Because exploitation requires a local low-privileged logon (PR:L, AV:L), an effective interim control is to restrict who can authenticate interactively to the servers hosting JD Edwards EnterpriseOne Tools - remove shared and generic OS accounts, enforce least privilege, and limit interactive logon rights to a named administrative group; the trade-off is reduced operational flexibility for support staff and possible friction during maintenance windows. Additionally, segment the Tools installation directories and the installation-security configuration files so that non-administrative accounts have read-only or no access, and monitor host logs for repeated availability-degrading actions or service restarts initiated by low-privileged users; this adds auditing overhead but does not stop a determined local attacker. Restricting access at the network perimeter alone will not mitigate this vulnerability, since the vector is local rather than remote - do not treat firewall rules as a substitute for patching or host-level privilege reduction.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw sits in the Installation Security component of Oracle JD Edwards EnterpriseOne Tools, the Java-based middleware layer that underpins the EnterpriseOne ERP suite and handles installation-time security configuration. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L describes a local attack path: the adversary must already have interactive access to the host running the Tools component and a low-privileged account, then can manipulate installation-security behavior to consume or lock resources that reduce service availability. Scope is unchanged (S:U), meaning impact is contained within the vulnerable component rather than crossing a trust boundary into other EnterpriseOne tiers - an important limit that keeps this out of the remote, unauthenticated category entirely. No CWE identifier was supplied in the available data, so the precise root-cause class (for example resource exhaustion or improper handling of installation-time permissions) cannot be confirmed; the observed consequence maps to the availability-only impact class. The absence of C/I impact and the PR:L/AV:L prerequisites mean this is a post-authentication, host-local availability nuisance rather than a data-exposure or takeover primitive, which is consistent with the 3.3 base score.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Local access with an existing low-privileged account gives AV:L and PR:L; low complexity is AC:L; only a partial availability impact applies, so C:N/I:N/A:L.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 3.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB