EUVD-2026-106348
GHSA-gh38-2j3r-2cj7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged user
-
ExploitSend crafted HTTP request to Interoperability SEC
-
ExecutionExploit flaw in integration component
-
ImpactAccess critical JD Edwards data / trigger partial DoS
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid low-privileged JD Edwards EnterpriseOne Tools account (PR:L) with network HTTP access to the Interoperability SEC component on an affected version (9.2.0.0 through 9.2.26.5); no user interaction is needed and attack complexity is low. The practical limiting factor is that the attacker must already hold application credentials and must be able to reach the interoperability/integration endpoint - organizations that restrict network exposure of this component or tightly control account provisioning materially reduce exposure. It is not remotely exploitable by a fully unauthenticated attacker. |
| Impact | This is a moderate-but-genuine priority rather than a theoretical high-CVSS issue, though several signals are absent. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L, base 7.1) describes a network-reachable, low-complexity flaw in the Interoperability SEC component requiring only low privileges and no user interaction, yielding high confidentiality impact plus a partial availability impact (no integrity impact). No EPSS score, KEV listing, or public POC was provided in the input, so there is no evidence of active exploitation or widespread automated attack at this time - exploitation probability cannot be quantified from the data available. The chief tension in the data is the 'Authentication Bypass' tag versus the CVSS PR:L metric: PR:L explicitly means a low-privileged (authenticated) attacker is required, which contradicts a true authentication bypass - this tag appears mislabeled and should be verified against Oracle's advisory. Because the vulnerability sits in an interoperability/integration component that is often network-exposed, and because any authenticated JD Edwards user (a large population in ERP deployments) could abuse it to reach critical data, this warrants prompt patching in the normal Oracle CPU cycle rather than emergency treatment. No public exploit identified at time of analysis. |
| Exploit ScenarioDerived | An attacker holding a low-privileged JD Edwards EnterpriseOne application account sends a crafted HTTP request to the exposed Interoperability SEC component. Exploitation is rated easy (AC:L) and needs no user interaction, allowing the attacker to read critical or all JD Edwards-accessible data and induce a partial denial of service. No public exploit code is known to exist at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Authenticated low-privileged users with HTTP access to the Interoperability SEC component of JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 can read critical application data beyond their intended authorization scope and trigger a partial denial of service, as addressed in Oracle's October 2026 Critical Patch Update. The CVSS 3.1 score of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L) reflects high confidentiality impact and low availability impact, gated only by the need for a valid low-privilege account and reachable integration endpoints. No public exploit code or confirmed active exploitation (CISA KEV) was identified at the time of analysis, and the tag 'Authentication Bypass' indicates the weakness is an authorization/access-control gap rather than a pre-auth entry point.
RemediationAI
Vendor patching is the primary fix: Oracle published this issue in the October 2026 Critical Patch Update at https://www.oracle.com/security-alerts/cpuoct2026.html, which supersedes the affected 9.2.0.0-9.2.26.5 range - apply the CPU-recommended EnterpriseOne Tools patch level and confirm the resulting build is above 9.2.26.5. Where patching must be staged, compensating controls materially reduce exposure but do not eliminate it: restrict network reachability of the interoperability and AIS endpoints to known integration hosts via firewall rules or an allowlist (trade-off: can break third-party connectors and batch integrations until rules are tuned), and disable integration services that are not actively in use (trade-off: requires an inventory of consumers first). Tighten identity hygiene by reviewing low-privilege account assignments, removing dormant integration accounts, and enforcing least privilege on roles that can reach SEC-protected services; monitor integration accounts for anomalous bulk-read or resource-exhaustion patterns that would indicate exploitation attempts. Because exploitation requires valid credentials, credential-rotation and session-monitoring controls add detection value even after network restrictions are in place.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
JD Edwards EnterpriseOne Tools is the middleware/technology stack layer of Oracle's ERP suite, and its Interoperability component is the integration surface that exposes business services, connectors, and the AIS/web-service endpoints used to exchange data with external systems. The 'Interoperability SEC' subcomponent governs the security checks applied to that channel - authentication, role resolution, and authorization of which business functions and tables an integration caller may reach. The supplied data assigns no CWE, but the 'Authentication Bypass' tag combined with C:H/N (high confidentiality, no integrity impact) and the PR:L vector is characteristic of an improper-authorization class defect (best fit CWE-863 Incorrect Authorization, or CWE-862 Missing Authorization) in which the SEC layer fails to enforce role-scoped restrictions, letting an already-authenticated low-privilege account read data it should not see. The A:L component indicates a secondary path that degrades availability, consistent with a resource-exhaustion or unsafe-request-handling condition in the same integration endpoint. Scope is unchanged (S:U), so the impact remains inside the EnterpriseOne security authority; AC:L/UI:N means no race condition, configuration quirk, or victim interaction is needed - only credentials and network reachability. The practical constraint is network exposure: organizations that firewall off the interoperability/AIS listeners or strictly limit integration account provisioning shrink the attack surface considerably.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
HTTP network vector (AV:N), easy exploitation (AC:L), authenticated low-privileged user required (PR:L); high data read (C:H) with partial DoS (A:L) and no integrity impact.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L).
Executive ViewAI
JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 contains an access-control weakness in its Interoperability SEC component that could allow authenticated low-privilege integration users to view sensitive application data and cause partial service disruption. Leadership should prioritize this because affected organizations may face unauthorized exposure of critical business records and localized operational outages. No public exploit identified at time of analysis, but the access-control gap still warrants action because it affects sensitive data and service availability.
No vendor-released patch identified at time of analysis; restrict network access to Interoperability SEC endpoints to trusted integration accounts, enforce least privilege and review authorization scopes for low-privilege users, enable detailed audit logging and alerting for abnormal data reads or availability degradation, and monitor Oracle's October 2026 Critical Patch Update guidance for a vendor fix.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB