EUVD-2026-106424
GHSA-8g8x-25gw-3fmv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain high-privileged local logon
-
ExploitAccess Package Build SEC component
-
ExecutionExploit flaw for takeover
-
ImpactFull compromise of EnterpriseOne Tools
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires (1) local logon access to the host infrastructure where JD Edwards EnterpriseOne Tools executes (AV:L - not remotely reachable over a network) and (2) pre-existing high privileges on that system (PR:H), specifically to interact with the Package Build SEC component. No user interaction is needed (UI:N) and attack complexity is low (AC:L). The key limiting factors are the local-access requirement and the high-privilege prerequisite, which together confine realistic exploitation to compromised privileged accounts or malicious insiders rather than external unauthenticated attackers; only EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5 are affected. |
| Impact | This is a moderate-priority, not high-urgency issue despite its CRITICAL-sounding 'takeover' language. The CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:U) is the dominant signal: exploitation requires LOCAL logon access to the infrastructure where JD Edwards EnterpriseOne Tools runs AND already-high privileges (PR:H). An attacker who already holds high privileges on the host has limited additional to gain, which is precisely why the base score lands at 6.7 (Medium) rather than critical - the impact (C:H/I:H/A:H, full product takeover) is severe, but the access barrier is substantial. No EPSS score was supplied, no CISA KEV listing is present, and no POC is referenced, so there is no exploitation-probability data to contrast against the CVSS metrics. The only source is Oracle's own Critical Patch Update advisory (secalert_us@oracle.com), with no independent SSVC/automatable assessment available. Net: a legitimate patch-management item for JD Edwards operators, but not an emergency given the local-access-plus-high-privilege precondition and absence of any active-exploitation or POC signal. |
| Exploit ScenarioDerived | An attacker who has already obtained a high-privileged local account (e.g., a compromised administrator or insider) on the server hosting JD Edwards EnterpriseOne Tools abuses a flaw in the Package Build SEC component to fully compromise the EnterpriseOne Tools instance. No user interaction is required, and attack complexity is low, but the attacker must first possess both local logon access and high privileges. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Local, highly privileged users on hosts running Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 can exploit the Package Build SEC component to compromise the confidentiality, integrity, and availability of the installation, with a CVSS 3.1 base score of 6.7. Exploitation requires logon access to the underlying infrastructure and pre-existing high privileges, so realistic exposure is limited to malicious insiders or attackers who have already compromised a privileged account rather than external unauthenticated users. No public exploit code was identified and the issue is not confirmed as actively exploited at time of analysis, making this a moderate-priority hardening item rather than an emergency patch.
RemediationAI
Apply the Oracle Critical Patch Update for October 2026, which addresses this issue; the supplied data references the advisory at https://www.oracle.com/security-alerts/cpuoct2026.html but does not state an exact patched version number, so confirm the fixed Tools release against that advisory before upgrading. Until patching, restrict local logon and administrative privileges on hosts running EnterpriseOne Tools to trusted personnel, review and remove unnecessary high-privilege accounts, and monitor Package Build SEC activity for unexpected builds or configuration changes. As compensating controls, isolate build hosts on segmented management networks and enforce least privilege for package-build operators; these reduce exposure but do not remove the underlying flaw and may slow legitimate build operations or generate additional audit volume. Note that the vendor advisory is the authoritative source for the fixed release and any required prerequisite patches.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected technology is Oracle JD Edwards EnterpriseOne Tools, the middleware and tooling layer used to build, deploy, and administer EnterpriseOne applications. The flaw resides in the Package Build SEC component, which handles security-related aspects of the package build process used to assemble and deploy application objects. No CWE was assigned in the supplied data, so the precise root-cause class is not formally categorized; the CVSS vector (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) indicates a local attack path requiring high privileges but no user interaction, with low complexity and full impact to confidentiality, integrity, and availability within the same security scope. Because the attack is local rather than network-reachable, the primary technical risk is abuse of legitimate administrative or build access rather than remote exploitation. CPE identifiers were not provided; the EUVD entry confirms the affected range as JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Local logon to the hosting infrastructure dictates AV:L, the attacker must already hold high privileges so PR:H, and full product takeover yields C:H/I:H/A:H with unchanged scope.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Package Build SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB