EUVD-2026-106522
GHSA-p489-q3jg-65fc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged EnterpriseOne account
-
DeliveryReach Web Runtime SEC over HTTP
-
ExploitSend crafted request exploiting flaw
-
ExecutionEscalate to full application control
-
ImpactTake over JD Edwards EnterpriseOne Tools
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network access to the JD Edwards EnterpriseOne Tools web tier over HTTP and an authenticated low-privileged account (CVSS PR:L), targeting the Web Runtime SEC component on supported versions 9.2.0.0 through 9.2.26.5. No user interaction is required (UI:N) and attack complexity is low (AC:L). The primary limiting factors are the need for valid low-privilege credentials and network reachability of the EnterpriseOne web runtime; internet-exposed instances are at materially higher risk than those restricted to internal networks. No non-default configuration is cited by Oracle as a precondition. |
| Impact | This is a genuinely high-priority flaw, not merely a high-CVSS-but-low-real-risk issue. The Oracle-provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes network-reachable exploitation over HTTP with low attack complexity, no user interaction, and only a low-privilege account required, yielding full confidentiality, integrity, and availability compromise ('takeover'). Oracle explicitly labels it 'easily exploitable,' which aligns with the AC:L/UI:N metrics. However, several signals that would normally sharpen prioritization are ABSENT from the provided data: there is no EPSS exploitation-probability score, no CISA KEV listing, and no POC indicator - so exploitation status is 'no public exploit identified at time of analysis.' There is also no SSVC decision record supplied. The one notable conflict is the 'Information Disclosure' tag, which understates the actual impact: the description and the C:H/I:H/A:H vector describe full system takeover, not mere disclosure - treat the tag as incomplete. Net: a real, broadly applicable vulnerability in an enterprise ERP that warrants prompt patching during the Oracle October 2026 CPU cycle, but current evidence points to no confirmed in-the-wild exploitation, so urgency is driven by ease of exploitation rather than active attacks. |
| Exploit ScenarioDerived | An attacker who holds any low-privileged JD Edwards EnterpriseOne Tools account (or obtains such credentials) sends crafted HTTP requests to the Web Runtime SEC component to escalate to full control of the application. Because the CVSS vector is AV:N/AC:L/PR:L/UI:N, no victim interaction and only minimal privilege are needed, making the attack straightforward once network access to the web tier exists. No public proof-of-concept exploit has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 20, 2026
Authenticated low-privileged users with HTTP reachability to the JD Edwards EnterpriseOne Tools web tier can take full control of the Web Runtime SEC component in versions 9.2.0.0 through 9.2.26.5, with high confidentiality, integrity, and availability impact (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The barrier to entry is low: any valid non-administrative EnterpriseOne account plus network access to the HTML/web runtime is sufficient, with no user interaction and no non-default configuration precondition cited by Oracle. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, but EPSS scoring was not available in the supplied intelligence, so prevalence-weighted risk should be treated as unquantified rather than low.
RemediationAI
Patch available per vendor advisory: apply the Oracle Critical Patch Update for October 2026 (https://www.oracle.com/security-alerts/cpuoct2026.html) and move the EnterpriseOne Tools installation to the first release level above 9.2.26.5, which is the top of the affected range; Oracle CPUs are cumulative, so applying the latest CPU also covers this fix and any intervening ones. Because the flaw is post-authentication, patching the web tier is the only complete remediation - no configuration toggle or feature disable is documented by Oracle as a workaround. Compensating controls while scheduling the update: restrict network reachability of the EnterpriseOne HTML/web runtime to trusted networks or VPN with MFA (materially reduces exposure given AV:N, but does nothing against a malicious insider or a compromised low-privilege account), enforce least privilege and aggressive deprovisioning of EnterpriseOne accounts to shrink the population of usable PR:L credentials, and add web-tier logging/alerting for authorized users invoking security-sensitive runtime endpoints outside their normal role pattern. If a WAF is deployed in front of the runtime, virtual-patch rules targeting anomalous requests to the Web Runtime SEC servlets can add friction, at the cost of false positives on legitimate business transactions and the need for regression testing. After patching, rotate credentials and secrets associated with accounts that had access to the web runtime during the exposure window, and review web-tier and database audit logs for evidence of privilege escalation or unauthorized data access, since the high integrity and confidentiality impact means successful exploitation would not necessarily leave obvious availability symptoms.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
JD Edwards EnterpriseOne Tools is the middleware/runtime layer beneath the EnterpriseOne ERP suite, and its 'Web Runtime SEC' component implements the security enforcement logic used by the HTML/web client - session handling, authentication and authorization checks, and role-based access decisions applied to web runtime requests. Oracle does not publish a CWE mapping for this advisory, so the precise defect class (for example a missing authorization check, unsafe deserialization, or trust-boundary error in the web runtime security servlets) is undisclosed; what is disclosed is the consequence pattern: a low-privileged authenticated principal can cross a privilege boundary over ordinary HTTP and obtain full control of the runtime, implying broken access control or improper privilege management rather than simple information leakage. Notably, the vendor-supplied tags reference 'Information Disclosure', which is narrower than the CVSS vector's high C/I/A impact and the description's 'takeover' language - analysts should treat the tags as incomplete metadata rather than a downgrade of impact. The PR:L metric is the key architectural detail: the flaw sits post-authentication, so it is not wormable or pre-auth exploitable, and detection should focus on anomalous authorized-user behavior rather than anonymous attack traffic. No CPE identifiers were supplied with the source data; EUVD lists the affected range as 9.2.0.0 ≤ 9.2.26.5.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Oracle describes easy HTTP-based exploitation by a low-privileged user with no interaction and full takeover, so AV:N/AC:L/PR:L/UI:N and C/I/A:H.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5 carry a high-severity exposure in the web runtime security component that could allow an authenticated low-privileged user with network access to compromise ERP confidentiality, integrity, and availability. The business risk is concentrated in core financial and operational workflows, where a compromised or malicious standard user account could have disproportionate impact. There is no public exploit identified at time of analysis, but because no vendor-released patch identified at time of analysis is available, leadership should treat this as a priority ERP resilience issue requiring containment and monitoring.
No vendor-released patch identified at time of analysis; restrict web-tier access to trusted networks, enforce MFA, review and minimize low-privileged EnterpriseOne accounts, monitor Web Runtime SEC logs for anomalous activity, segment the ERP web tier, validate backups, and engage Oracle support for mitigation guidance and patch timing.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB