EUVD-2026-106545
GHSA-9hhv-27cw-qc84
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local logon
-
ExploitReach Business Logic Infra SEC component
-
ExecutionExploit under required conditions
-
ImpactUnauthorized read/update of subset of data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the attacker to already hold a low-privileged account with interactive logon to the host infrastructure where JD Edwards EnterpriseOne Tools executes (AV:L, PR:L) - remote or unauthenticated exploitation is not possible. Exploitation is further limited by high attack complexity (AC:H), meaning success depends on specific conditions outside the attacker's control; no user interaction is required (UI:N). Affected deployments are JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5 running the Business Logic Infra SEC component. Impact is bounded to partial read and partial write of a subset of application-accessible data, with no availability impact. |
| Impact | This is a genuinely low-priority issue, and the signals are consistent in pointing that way. The CVSS 3.1 base score is 3.6 (Low) with a vector of AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N - exploitation requires local logon to the infrastructure (AV:L), is difficult to carry out (AC:H), and needs an already-authenticated low-privileged account (PR:L), while impact is limited to partial confidentiality and integrity (C:L/I:L) with no availability impact. No EPSS score, SSVC decision data, KEV listing, or public POC was provided in the input, so there is no evidence of exploitation interest; absence of these is not itself an error but reinforces that this is a theoretical, high-barrier flaw rather than an urgent one. One concrete conflict exists: the input Tags label this 'Authentication Bypass,' but the Oracle description describes a privileged, logon-required data-access flaw with no mention of bypassing authentication - the tag appears mislabeled and should not drive triage. Net: a low-CVSS, low-real-risk issue appropriate for routine patching in the normal Oracle CPU cycle, not emergency remediation. |
| Exploit ScenarioDerived | An attacker who already has a valid low-privileged account and local logon access to the server where JD Edwards EnterpriseOne Tools runs leverages a flaw in the Business Logic Infra SEC component to read a subset of application data and perform limited unauthorized update, insert, or delete operations. The high attack complexity (AC:H) means success depends on specific timing or environmental conditions, making reliable exploitation difficult. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Low-privileged users who already hold interactive logon to the host running Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 can, under narrowly specific conditions, read and modify a limited subset of the application's data through the Business Logic Infra SEC component. Impact is confined to partial confidentiality and integrity loss (CVSS 3.1 base 3.6, AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N) with no availability effect, and exploitation is neither remote nor unauthenticated. No public exploit code or confirmed active exploitation was identified at time of analysis, and the overall risk picture is genuinely low priority.
RemediationAI
Patch available per vendor advisory: apply the Oracle October 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpuoct2026.html), which covers JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 - the input data does not specify an exact minimum patched Tools release, so confirm the fixed build number in the CPU before closing the finding. Because the attack prerequisite is an interactive low-privileged logon to the EnterpriseOne host, the most effective compensating controls are host-level: restrict who can log on to the JD Edwards Tools servers (RDP/console access, OS-level group membership) and remove stale or shared low-privilege accounts, accepting that this narrows operational convenience for support staff; enforce least privilege and segregate duties on EnterpriseOne roles so no single low-privileged user holds broad Business Logic Infra SEC reach, at the cost of additional role administration effort; and enable audit logging of data change operations in EnterpriseOne so unauthorised insert/update/delete activity linked to this component is detectable. Network segmentation of the Tools server subnet adds defence in depth but does not remove the local-access prerequisite, so it should not substitute for patching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue sits in the Business Logic Infrastructure Security component of Oracle JD Edwards EnterpriseOne Tools, the middleware layer that brokers authentication and authorisation decisions for the EnterpriseOne application stack rather than the ERP business applications themselves. Oracle assigned no CWE and published the finding through its October 2026 Critical Patch Update; the underlying weakness is consistent with an access-control/privilege-boundary flaw, where the security infrastructure fails to fully restrict what a valid low-privileged session can read or write. The CVSS vector makes the exploitation model explicit: AV:L and PR:L require the attacker to already possess a working low-privileged account with interactive access to the host infrastructure, AC:H means success hinges on race conditions, timing, or specific configuration state outside the attacker's control, UI:N means no victim interaction is needed, and S:U with C:L/I:L/A:N bounds the outcome to partial read and partial write of application-accessible data. Note the source tag 'Authentication Bypass' should be read alongside the assessed vector, which does not support unauthenticated or remote bypass - the practical effect is privilege-scope circumvention within an already authenticated session, not an unauthenticated entry point.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Local logon by an existing low-privileged user is required (AV:L, PR:L), success is condition-dependent (AC:H), and impact is limited partial read/write with no availability loss (C:L/I:L/A:N).
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Business Logic Infra SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data as well as unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 3.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N).
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB