EUVD-2026-37225Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged Tools account
-
DeliveryReach EnterpriseOne Tools HTTP endpoint
-
ExploitSend crafted request to Infrastructure Security component
-
ExecutionBypass authorization across scope boundary
-
ImpactRead or modify critical JD Edwards data
Vulnerability Assessment
| Weakness |
CWE
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker must hold a valid low-privileged account on JD Edwards EnterpriseOne Tools 9.2.0.0-9.2.26.2 (PR:L) and have HTTP network reachability to the Tools service; no user interaction is required (UI:N) and attack complexity is low (AC:L). Limiting factors: exploitation requires authenticated access, so internet-exposed or weakly segmented EnterpriseOne deployments where low-tier accounts are easy to obtain are the realistic risk, while installations restricting Tools HTTP endpoints to an internal admin network and enforcing strong credential hygiene materially raise the bar. No specific non-default configuration is called out in the Oracle description. |
| Impact | Real-world risk is high: the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) gives a 9.6 base score driven by network reachability, low complexity, only low privileges required, no user interaction, and a scope change that lets the attack reach beyond Tools into other JD Edwards products. EPSS data was not provided, and the CVE is not listed in CISA KEV, so there is no public exploitation probability or active-exploitation evidence to compare against the CVSS signal. Because Oracle CPU advisories typically lack technical detail and no POC has been published, exploitation is currently theoretical but should be treated as high priority: JD Edwards systems are ERP-class targets storing financial and HR data, and the 'easily exploitable' wording with PR:L means any authenticated low-tier Tools user (a common population in ERP deployments) can pivot to full data compromise. |
| Exploit ScenarioDerived | An attacker obtains or compromises a low-privileged JD Edwards EnterpriseOne Tools account - for example, a routine business user with HTTP login rights - and sends crafted HTTP requests to the Enterprise Infrastructure Security component to escape their authorization scope. Leveraging the scope change, they read or modify financial, HR, or master data across JD Edwards modules that their account would not normally be permitted to touch. No public POC is currently available, but the low attack complexity makes weaponization straightforward once technical details emerge. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 16, 2026
Privilege escalation and scope-change attack in Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.2 allows a low-privileged attacker with HTTP network access to compromise the Enterprise Infrastructure Security component and impact additional connected products. Successful exploitation yields full read access and the ability to create, modify, or delete all data accessible to JD Edwards EnterpriseOne Tools. No public exploit identified at time of analysis, and the issue was reported by Oracle as part of the June 2026 Critical Patch Update.
RemediationAI
Patch available per Oracle's June 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cspujun2026.html; apply the EnterpriseOne Tools release issued in that CPU (a version above 9.2.26.2) as the primary fix. Until patching is possible, compensating controls include restricting HTTP access to the EnterpriseOne Tools administrative and security endpoints to a trusted management VLAN or via reverse-proxy ACLs (side effect: may block legitimate remote admin consoles), tightening Tools role assignments to remove unnecessary low-privilege accounts that could be abused (side effect: operational friction for power users), and enabling enhanced audit logging on the Enterprise Infrastructure Security component to detect anomalous cross-product data access (side effect: increased log volume and storage). Do not expose JD Edwards EnterpriseOne Tools HTTP services directly to the internet.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
JD Edwards EnterpriseOne Tools is the runtime, middleware, and security infrastructure layer that underpins Oracle's JD Edwards EnterpriseOne ERP suite, exposing HTTP-based services for application server administration, security configuration, and inter-component communication. The flaw resides in the Enterprise Infrastructure Security component (CPE cpe:2.3:a:oracle_corporation:jd_edwards_enterpriseone_tools), which handles authentication, authorization, and trust boundaries between Tools and downstream EnterpriseOne applications. While the CVE record lists CWE as N/A, the Oracle-supplied tag 'Authentication Bypass' combined with the CVSS scope change (S:C) indicates the weakness most likely lies in improper authorization or trust validation across component boundaries, where a low-privileged Tools user can break out of their security context to act on resources owned by other JD Edwards products.
Know when Jd Edwards Enterpriseone Tools gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
HTTP-reachable service (AV:N), low complexity per Oracle (AC:L), requires a low-privileged Tools account (PR:L), no UI, and authorization break across components causes scope change with high C/I but no availability impact.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure Security). Supported versions that are affected are 9.2.0.0-9.2.26.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. While the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 9.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).
Executive ViewAI
Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.2 contain a critical privilege escalation vulnerability allowing low-privileged users to compromise the Enterprise Infrastructure Security component and gain full control over all business data in the system. Affected organizations face immediate risk of unauthorized data access, modification, and deletion across their ERP environment and integrated applications with no available patch. This vulnerability requires emergency mitigation across all deployments.
No vendor-released patch identified at time of analysis. Interim mitigations: Restrict network access to JD Edwards Enterprise Infrastructure Security via firewall segmentation; enforce strict least-privilege access for low-privilege user accounts; require multi-factor authentication for administrative functions; implement real-time audit logging of data access and modifications; deploy intrusion detection monitoring for privilege escalation patterns; maintain offline backups of critical data with tested recovery procedures.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events
In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Rated cri
The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly
In OpenSSL 1.1.0 before 1.1.0d, if a malicious server supplies bad parameters for a DHE or ECDHE key exchange then this
A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL proto
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, rela
jQuery-UI is the official jQuery user interface library. Rated medium severity (CVSS 6.1), this vulnerability is remotel
An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. Rated med
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, rela
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, rela
It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. Rated critical severity (CVS
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, rela
GitHub PoC
Exploit-DB