EUVD-2026-106428
GHSA-358f-hjpq-v765
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privileged JD Edwards account
-
ExploitSend crafted request over JDENET
-
ExecutionBypass data authorization controls
-
ImpactCreate, modify, or delete critical Homebuilder data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated low-privileged account on JD Edwards EnterpriseOne Homebuilder 9.2 with network reachability to the JDENET communication protocol; exploitation targets the Homebuilder Management component. Limiting factors: the attacker must already possess valid (even if minimal) credentials (PR:L), so this is not remotely exploitable by an anonymous user; impact is confined to integrity of Homebuilder-accessible data with no confidentiality or availability effect; only version 9.2 is stated as affected. No special non-default feature or configuration toggle is named in the description - the JDENET interface is a standard part of the EnterpriseOne architecture. |
| Impact | This is a moderate-severity integrity flaw (CVSS 3.1 6.5) in Oracle JD Edwards EnterpriseOne Homebuilder 9.2, disclosed through Oracle's October 2026 Critical Patch Update. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) indicates network-reachable, low-complexity exploitation by an already-authenticated low-privileged user via the JDENET protocol, with high integrity impact but NO confidentiality or availability impact. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation or weaponization - this reads as a priority-driven patch item rather than an emergency. The key tempering signal is PR:L: an attacker must first hold valid credentials on the Homebuilder environment, which substantially narrows the realistic threat to insiders or attackers who have already obtained a foothold. The provided CVSS and the description are consistent (both point to a low-privileged network-based integrity attack); the only conflicting signal is the input 'Authentication Bypass' tag, which contradicts the explicit PR:L authentication requirement and appears mislabeled. |
| Exploit ScenarioDerived | A low-privileged but authenticated user (or an attacker who has compromised a low-level JD Edwards account) sends crafted requests over the JDENET protocol to the Homebuilder Management component. Because the flaw grants unauthorized create/modify/delete access to critical data, the attacker tampers with homebuilder business records - altering or destroying financial, contract, or project data - without needing elevated privileges. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Integrity compromise in Oracle JD Edwards EnterpriseOne Homebuilder 9.2 lets a low-privileged, authenticated attacker reach the Homebuilder Management component over JDENET and create, delete, or modify critical business data at will. Only version 9.2 is listed as affected, and the flaw is rated CVSS 3.1 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) - no confidentiality or availability impact, but total loss of integrity for data the account can reach. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and the attacker must already hold valid credentials, so this is not anonymously exploitable.
RemediationAI
Apply the Homebuilder Management fix shipped in the Oracle October 2026 Critical Patch Update for EnterpriseOne 9.2 (advisory: https://www.oracle.com/security-alerts/cpuoct2026.html) - this is the only vendor-released patch path identified in the available data, and no discrete patch number beyond the CPU reference was provided, so confirm the applicable Homebuilder patch/ESU with Oracle Support before scheduling. Where patching must be staged, compensating controls are to restrict network reachability to the JDENET listener so only trusted application/web servers and known administration subnets can connect (trade-off: breaks remote and HTML-client access from other segments and can interrupt integrations), to audit and aggressively trim Homebuilder Management role grants and EnterpriseOne user accounts down to least privilege (trade-off: workflow and job-cost users may lose legitimate functions and require re-provisioning), and to enable database-level auditing or change-data-capture on Homebuilder tables to detect anomalous creates, deletes, and modifications from low-privileged sessions (trade-off: storage growth and measurable write-path overhead). Because exploitation requires only valid low-privilege credentials, prioritise credential hygiene - rotation, MFA at the access layer, and review of accounts with default or shared passwords - and monitor JDENET traffic for unexpected Homebuilder business-function calls from accounts that do not normally use the module.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
JD Edwards EnterpriseOne is Oracle's ERP suite, and JDENET is its proprietary network messaging layer that carries business function calls and data between EnterpriseOne clients, web servers, and logic servers. The Homebuilder Management module is a specialized vertical component used for construction/home-building job cost and lot management on top of the EnterpriseOne 9.2 platform. The vulnerability sits in the handling of requests reaching Homebuilder Management through JDENET, and the effect pattern (C:N/I:H/A:N with PR:L) is characteristic of a broken access-control / improper-authorization condition (CWE-284/862 class, though no CWE was assigned in the supplied data) in which a session is not sufficiently constrained to its intended role scope before business logic executes. The supplied tags include 'Authentication Bypass', but the assessed vector requires a valid low-privileged account (PR:L), so the weakness should be read as a failure to enforce authorization boundaries between a minimal-privilege user and Homebuilder Management operations rather than anonymous access to the system. No non-default feature toggle is named; the JDENET interface is standard to the EnterpriseOne architecture, so exposure follows normal deployment topology.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Network-reachable via JDENET (AV:N), low complexity, but requires valid low-privileged credentials (PR:L); impact is integrity-only (I:H, C:N, A:N) per the description.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the JD Edwards EnterpriseOne Homebuilder product of Oracle JD Edwards (component: Homebuilder Management). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Homebuilder. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Homebuilder accessible data. CVSS 3.1 Base Score 6.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N).
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB