EUVD-2026-106520
GHSA-rhrr-hq2q-g33p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local logon on JDE host
-
ExploitAbuse Monitoring and Diagnostics SEC component
-
ExecutionCross scope boundary (S:C)
-
ImpactRead/modify/delete critical JDE and connected-product data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already possess a valid low-privileged account with interactive logon to the infrastructure/server where JD Edwards EnterpriseOne Tools (versions 9.2.0.0 through 9.2.26.5) executes, specifically reachable via the Monitoring and Diagnostics (SEC) component. It is NOT remotely exploitable over the network (AV:L) and needs no user interaction (UI:N). Limiting factors: the mandatory local logon and existing credentials mean exploitation is confined to insiders or post-foothold attackers; however, once those conditions are met attack complexity is low (AC:L) and the scope change (S:C) extends impact to additional connected products. |
| Impact | This is a genuinely serious but access-gated vulnerability rather than a mass-exploitation threat. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N, 8.4) shows the elevated score is driven by the scope change (S:C) combined with High confidentiality and integrity impact - not by remote reach. Crucially, AV:L and PR:L mean the attacker must already have a local logon and valid low-privileged credentials on the host where JD Edwards EnterpriseOne Tools runs, so this is not an internet-facing, pre-auth issue. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net: a high-value flaw for an attacker who already has a foothold (insider or post-compromise lateral movement), but the local-access precondition sharply limits real-world widespread exploitation. Note a conflict in the metadata: the input tag 'Authentication Bypass' contradicts the vector's PR:L (authentication required) and the description's 'low privileged attacker with logon' - treat the auth-bypass label as suspect and verify against Oracle's CPU advisory. |
| Exploit ScenarioDerived | An attacker who already holds a low-privileged account on the server hosting JD Edwards EnterpriseOne Tools - for example a rogue employee or an adversary who gained an initial foothold via another vector - abuses the Monitoring and Diagnostics (SEC) component to cross a scope boundary. From there they read, create, modify, or delete critical data across all JD Edwards-accessible data and may significantly impact additional connected products. No public exploit code is identified at this time, and no user interaction is required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 20, 2026
Low-privileged local users with logon access to a JD Edwards EnterpriseOne Tools host can bypass authentication in the Monitoring and Diagnostics (SEC) component and gain read/write control over critical data. Affected releases are Tools 9.2.0.0 through 9.2.26.5; exploitation requires an existing interactive account on the server (CVSS vector AV:L/PR:L), so the realistic threat is insider abuse or an attacker operating after an initial foothold, not a remote mass-exploitation campaign. Impact is rated CVSS 8.4 because a scope change (S:C) lets the compromise spill into connected products and the underlying ERP data, though no public exploit code and no confirmed active exploitation were identified at time of analysis.
RemediationAI
Apply the JD Edwards EnterpriseOne Tools fix delivered in the Oracle Critical Patch Update of October 2026 (https://www.oracle.com/security-alerts/cpuoct2026.html); consult that advisory and My Oracle Support for the precise minimum Tools release and any required prerequisite patches above the affected 9.2.0.0-9.2.26.5 range, since an exact fixed version number was not included in the available data. Until patching is complete, treat the Monitoring and Diagnostics SEC component as an administrative surface: restrict interactive logon to the Tools server and its OS accounts to a short list of trusted administrators and remove shared or stale local accounts, accepting that this reduces operational flexibility and requires ongoing account governance; block network access to diagnostic/monitoring endpoints at the host firewall or place them behind an authenticated reverse proxy, at the cost of breaking legitimate health-check tooling that must then be run locally; enable and review audit logging for SEC component activity so privilege misuse is detectable; and segment the Tools host from other enterprise systems to contain the scope-change impact described by the vendor. Given the low-privileged local precondition and the current absence of public exploit code, prioritise patching where non-administrative users share hosts with the Tools server.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle JD Edwards EnterpriseOne Tools is the middleware and runtime foundation of the JD Edwards ERP suite, handling server management, logging, and diagnostic services. The flaw sits in the Monitoring and Diagnostics SEC component, which exposes diagnostic and monitoring functions to logged-on users; the vendor's tagging as an authentication bypass indicates those functions do not adequately verify that the calling principal is authorized for the privileged operations they invoke, so a low-privileged account can reach functionality reserved for administrators. No CWE identifier was published, but the vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) shows a local, low-complexity path requiring only valid credentials and no user interaction, with high confidentiality and integrity impact and no availability impact. The S:C scope change is significant: successful exploitation escapes the security authority of the Tools component itself and can affect other products reachable from it, which is why an otherwise locally-gated bug carries an 8.4 base score.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Requires local logon with existing low-privilege credentials (AV:L, PR:L), is easily exploitable (AC:L), and the component crosses a scope boundary (S:C) to high C/I impact with no availability effect.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools. While the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 8.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).
Executive ViewAI
JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 contains an authentication-bypass weakness in the Monitoring and Diagnostics (SEC) component that can let an authenticated local user gain read/write control over critical ERP data and potentially affect connected products. No public exploit identified at time of analysis, but because exploitation requires an existing interactive account, the immediate business risk is insider misuse or attacker activity after an initial foothold rather than broad external attack. Leadership should care because affected ERP hosts may hold sensitive business records, and the absence of a vendor patch leaves exposure dependent on access controls, monitoring, and data-integrity safeguards.
No vendor-released patch identified at time of analysis; restrict local interactive logon to essential named accounts, enforce least privilege and separation of duties, monitor SEC/Monitoring and Diagnostics activity and ERP data changes, segment or limit network access to affected hosts, and maintain validated backups for critical ERP data.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB