What is the CVSS score of EUVD-2026-37226?

EUVD-2026-37226 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of JD Edwards EnterpriseOne are affected by EUVD-2026-37226?

Oracle JD Edwards EnterpriseOne Order Promising 9.2 contains a critical vulnerability enabling low-privileged users to gain complete system control; while no public exploit has been identified at…

How to fix or mitigate EUVD-2026-37226?

24 hours: Restrict Order Promising Integration network access to pre-approved trusted networks; limit user access to essential personnel only; establish incident response team readiness. 7 days: Deploy monitoring on authentication and privilege escalation activities within the component; document all downstream system dependencies; request emergency patch status from Oracle. 30 days: Implement Web Application Firewall or authentication proxy adding additional access layer; monitor Oracle security advisories for patch release; plan and execute upgrade to patched JD Edwards version.

JD Edwards EnterpriseOne EUVD-2026-37226

| CVE-2026-46907 CRITICAL

Improper Access Control (CWE-284)

2026-06-16 oracle

Authentication Bypass Oracle Jd Edwards Enterpriseone Order Promising Oracle Corporation

9.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

HTTP-reachable integration endpoint (AV:N, AC:L) requires a low-privileged JDE account (PR:L), no user interaction, and Oracle explicitly states scope change with full CIA takeover.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 22:16 vuln.today

DescriptionCVE.org

Vulnerability in the JD Edwards EnterpriseOne Order Promising product of Oracle JD Edwards (component: Order Promising Integration). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Order Promising. While the vulnerability is in JD Edwards EnterpriseOne Order Promising, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Order Promising. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Takeover of Oracle JD Edwards EnterpriseOne Order Promising 9.2 is possible by a low-privileged remote attacker through the Order Promising Integration component over HTTP. The flaw produces a CVSS 3.1 scope change, meaning successful exploitation can significantly impact other interconnected products in the JD Edwards ecosystem. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.

Technical ContextAI

Oracle JD Edwards EnterpriseOne is a suite of enterprise resource planning (ERP) applications widely deployed for supply chain, manufacturing, and financial operations. The vulnerable component is the Order Promising Integration module, which exposes HTTP-accessible interfaces used to compute promised delivery dates and orchestrate cross-module workflows. CWE classification is not provided by the source, but the CVSS scope-change behavior and full CIA impact are consistent with an authorization or input-validation weakness in an integration endpoint that subsequently affects downstream JD Edwards components. The affected CPE is cpe:2.3:a:oracle_corporation:jd_edwards_enterpriseone_order_promising:*:*:*:*:*:*:*:*, with version 9.2 explicitly enumerated in the EUVD entry.

RemediationAI

Apply the patch available per Oracle's June 2026 Critical Security Patch Update for JD Edwards EnterpriseOne (https://www.oracle.com/security-alerts/cspujun2026.html); Oracle has not published an independent fix version string beyond the CSPU bundle in the available data, so administrators should install the CSPU package for the 9.2 release line. As compensating controls until patching, restrict network reachability to the Order Promising Integration HTTP endpoints to known integration partners via firewall or reverse proxy ACLs, require mutual TLS or VPN for inbound integration traffic, and tighten the privileges granted to low-tier JD Edwards application accounts that can reach the integration component (acknowledging that restricting integration accounts may break upstream order-promising callers and should be validated in a staging environment first). Increase monitoring on the Order Promising Integration endpoints and on cross-component activity that could indicate scope-change exploitation against downstream JD Edwards modules.