EUVD-2026-106375
GHSA-2p6h-5x88-9v26
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local low-privileged logon
-
ExploitAbuse Enterprise Infrastructure SEC flaw
-
ImpactUnauthorized read and modify JDE data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an attacker to already possess a low-privileged account with interactive logon access to the server infrastructure hosting JD Edwards EnterpriseOne Tools (component: Enterprise Infrastructure SEC), affecting versions 9.2.0.0 through 9.2.26.5. There is no remote network vector (AV:L) and no user interaction is needed (UI:N). Exploitation is explicitly rated 'Difficult' by Oracle (AC:H), meaning success depends on specific conditions outside the attacker's full control. The requirement for both local host access and pre-existing authenticated credentials substantially limits the realistic attacker population to insiders or those who have already gained a foothold. |
| Impact | This is a genuinely low-priority issue despite being in a security component. The CVSS 3.1 base score of 3.6 is LOW, and every signal reinforces that: the vector AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N requires local logon to the host (AV:L), high attack complexity (AC:H - Oracle describes it as 'Difficult to exploit'), and an already-authenticated low-privileged account (PR:L). Impact is limited to partial confidentiality and integrity (C:L/I:L) with no availability impact (A:N) and no scope change (S:U). No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of exploitation activity - consistent with a difficult-to-exploit local flaw unlikely to see widespread or automated attacks. One conflict to verify: the input Tag 'Authentication Bypass' does not match the description, which describes post-authentication unauthorized data access by a low-privileged logged-on user, NOT a bypass of authentication - treat that tag as suspect. Overall this is a low-severity, defense-in-depth item, not an urgent patch priority. |
| Exploit ScenarioDerived | An attacker who already holds a low-privileged account and can log on to the server where JD Edwards EnterpriseOne Tools runs leverages a flaw in the Enterprise Infrastructure security component to read a subset of application data and perform limited unauthorized updates, inserts, or deletes. The high complexity (AC:H) means exploitation is not reliable and likely requires specific timing or environmental conditions. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
A low-privileged, locally authenticated user on a server hosting Oracle JD Edwards EnterpriseOne Tools (versions 9.2.0.0 through 9.2.26.5) can exploit a flaw in the Enterprise Infrastructure SEC component to read a limited subset of application data and to insert, update, or delete a limited set of records they should not be able to touch. Oracle rates exploitation as difficult (AC:H) and the attack is strictly local (AV:L) with no user interaction, yielding a CVSS 3.1 base score of 3.6; the realistic attacker population is therefore insiders or intruders who already hold a foothold and a valid low-privileged account on the E1 host. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, so this is a hardening and patch-cadence item rather than an urgent exposure.
RemediationAI
Apply the fix from Oracle's October 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpuoct2026.html), which is the authoritative source for the corrected EnterpriseOne Tools release; Oracle tools fixes are delivered as a Tools Release / ESU, so the exact minimum patched tools release number should be read from that advisory before upgrading rather than inferred, and the update should be staged against a test instance first because tools release upgrades touch the HTML and application server tiers. If the update cannot be applied on the normal cadence, compensating controls that fit the local, authenticated nature of the bug are: restrict interactive logon to the E1 application-server hosts to a small named set of administrators and service accounts (trade-off: slows DBA/ops support workflows and can break shared jump-host practices), remove or disable stale and shared low-privileged OS and EnterpriseOne accounts on those hosts and enforce per-user accountability (trade-off: user-provisioning overhead, potential disruption to batch/service identities), monitor and alert on unusual insert/update/delete activity and privilege changes originating from local sessions on the E1 servers (trade-off: SIEM tuning effort and false positives during month-end and batch runs), and network-segment the application-server tier so that only approved administration hosts can reach it (trade-off: added jump-host hops and possible impact on integrations that connect directly to the server). Because exploitation requires both host access and valid credentials, credential hygiene and local-account governance measurably reduce exposure while the patch is being scheduled.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
JD Edwards EnterpriseOne Tools is the middleware/runtime layer (HTML server, application server, security kernel, and supporting infrastructure services) that sits beneath the EnterpriseOne application and mediates authentication, session handling, and object-level access. The affected component is Enterprise Infrastructure SEC, the security-related portion of that tooling, and no CWE was supplied with the CVE, so the precise root-cause class (for example an access-control or input-handling defect) cannot be confirmed from available data. What the CVSS vector does establish is a local, authenticated attack path (AV:L, PR:L) that is rated difficult to execute (AC:H) with no user interaction (UI:N), unchanged scope (S:U), and partial confidentiality and integrity impact only (C:L/I:L/A:N) - meaning the defect does not hand an attacker arbitrary code execution or a full data compromise, but does break the intended isolation between a low-privileged account and a subset of EnterpriseOne-accessible data. Note a cross-source discrepancy worth flagging: third-party tagging labels this an 'Authentication Bypass', but the assessed vector requires a pre-existing low-privileged logon, so the tag likely reflects generic Oracle CPU categorization rather than a true pre-auth bypass and should not be used to raise severity. The ENISA EUVD entry (EUVD-2026-106375) mirrors the 9.2.0.0 ≤ 9.2.26.5 version range in the Oracle advisory.
Know when Jd Edwards Enterpriseone gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Requires local logon (AV:L) with existing low-privileged credentials (PR:L) and is hard to exploit (AC:H); partial read and write impact (C:L/I:L) and no availability effect (A:N).
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data as well as unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 3.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N).
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB