EUVD-2026-37222Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged JDE user credentials
-
DeliveryReach EnterpriseOne Tools HTTP endpoint
-
ExploitSend crafted request to Business Logic Infrastructure Security
-
ExecutionBypass authorization checks
-
PersistExecute privileged business logic
-
ImpactTake over JD Edwards EnterpriseOne Tools
Vulnerability Assessment
| Weakness |
CWE
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network HTTP reachability to the JD Edwards EnterpriseOne Tools web tier and a valid low-privileged EnterpriseOne account (PR:L), targeting the Business Logic Infrastructure Security component on Tools versions 9.2.0.0 through 9.2.26.2; no user interaction, no admin role, and no non-default configuration are called out. Limiting factors are the authentication requirement (an unauthenticated internet attacker cannot directly exploit) and the version constraint to the 9.2 Tools line - deployments isolated behind VPN/MFA and on patched Tools releases past 9.2.26.2 are not exposed. |
| Impact | Signals are largely aligned toward real priority: CVSS 8.8 with AV:N/AC:L/PR:L/UI:N and full High CIA, Oracle's own characterization as 'easily exploitable', and 'takeover' outcome all point to a serious, low-effort post-auth flaw. Counterweights are that PR:L requires existing valid credentials to the EnterpriseOne Tools web layer (mitigating purely external opportunistic attack), there is no EPSS, KEV, or SSVC data supplied, no POC has been published, and no CWE is assigned to confirm the root cause class. The tag 'Information Disclosure' in the input conflicts with the description's 'takeover' wording and C:H/I:H/A:H vector - the CVSS-and-description picture should be trusted over the loose tag. Net: treat as a high-priority patch for any internet-reachable or broadly-accessible JDE Tools deployment, especially where business users have HTTP access. |
| Exploit ScenarioDerived | An attacker who has obtained or been issued a low-privileged JD Edwards EnterpriseOne user account - for example a basic business user, a phished employee, or a contractor - sends crafted HTTP requests to the EnterpriseOne Tools web tier that abuse the Business Logic Infrastructure Security component to invoke or alter business logic outside their authorized scope. Because AC:L and UI:N apply, no special timing or user interaction is needed, and the result is full takeover of the Tools instance with read, modify, and disrupt capability over ERP data and processes. No public exploit identified at time of analysis, but the 'easily exploitable' wording suggests a working exploit could be developed quickly once technical details emerge. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 16, 2026
Authenticated takeover of Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.2 is possible via the Business Logic Infrastructure Security component, where a low-privileged attacker with HTTP network access can fully compromise confidentiality, integrity, and availability of the application. Oracle rates the issue 8.8 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, and no public exploit identified at time of analysis. The flaw is described as easily exploitable, making it a high-priority patch target for enterprises running affected Tools releases.
RemediationAI
Apply the fix delivered in Oracle's June 2026 Critical Patch Update for JD Edwards as documented at https://www.oracle.com/security-alerts/cspujun2026.html, upgrading EnterpriseOne Tools beyond the affected 9.2.0.0-9.2.26.2 range to the patched Tools release Oracle ships in that CPU (exact post-9.2.26.2 fix level should be taken from the Oracle advisory rather than assumed). Until patching, restrict HTTP access to the EnterpriseOne Tools web tier to trusted internal networks via firewall or reverse-proxy ACLs, tighten role assignments so that low-privileged business accounts cannot reach the Business Logic Infrastructure Security endpoints, and enforce MFA and credential hygiene to make the PR:L precondition harder to satisfy; note that network restrictions can block legitimate remote users and that role tightening may disrupt business function execution and should be staged.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
JD Edwards EnterpriseOne Tools provides the runtime, security, and middleware layer for the JD Edwards EnterpriseOne ERP suite, and the affected component - Business Logic Infrastructure Security - is the framework that enforces authorization and security controls around business function execution over HTTP. The CPE cpe:2.3:a:oracle_corporation:jd_edwards_enterpriseone_tools covers the Tools product across the 9.2 line. CWE is not assigned, but the combination of low privileges, no user interaction, network HTTP vector, and full CIA impact is consistent with an authorization-bypass or privilege-escalation flaw inside the Tools security layer that lets an authenticated user invoke or manipulate business logic they should not control.
Know when Jd Edwards Enterpriseone Tools gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
HTTP-reachable Tools endpoint gives AV:N/AC:L, a valid low-privileged JDE account is required so PR:L/UI:N, and full takeover yields C:H/I:H/A:H with no scope change.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Business Logic Infrastructure Security). Supported versions that are affected are 9.2.0.0-9.2.26.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle JD Edwards EnterpriseOne Tools (versions 9.2.0.0-9.2.26.2) contains a critical vulnerability enabling low-privileged authenticated users to achieve complete takeover of the application, compromising all data and system integrity. This affects a core enterprise resource planning platform managing financial transactions, inventory, and operational workflows across the organization, creating immediate risk of data theft, fraudulent transactions, and business continuity disruption.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict application access to VPN/corporate network only; enforce multi-factor authentication for all system logons; implement database activity monitoring and audit logging; deploy network intrusion detection focused on anomalous JD Edwards access patterns; conduct access reviews to minimize user privilege levels; isolate critical instances on dedicated network segments; establish daily security incident monitoring specifically for this vulnerability; prepare and test incident response playbook for potential compromise scenarios.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events
In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Rated cri
The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly
In OpenSSL 1.1.0 before 1.1.0d, if a malicious server supplies bad parameters for a DHE or ECDHE key exchange then this
A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL proto
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, rela
jQuery-UI is the official jQuery user interface library. Rated medium severity (CVSS 6.1), this vulnerability is remotel
An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. Rated med
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, rela
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, rela
It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. Rated critical severity (CVS
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, rela
GitHub PoC
Exploit-DB