EUVD-2026-37226Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
HTTP-reachable integration endpoint (AV:N, AC:L) requires a low-privileged JDE account (PR:L), no user interaction, and Oracle explicitly states scope change with full CIA takeover.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the JD Edwards EnterpriseOne Order Promising product of Oracle JD Edwards (component: Order Promising Integration). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Order Promising. While the vulnerability is in JD Edwards EnterpriseOne Order Promising, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Order Promising. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
AnalysisAI
Takeover of Oracle JD Edwards EnterpriseOne Order Promising 9.2 is possible by a low-privileged remote attacker through the Order Promising Integration component over HTTP. The flaw produces a CVSS 3.1 scope change, meaning successful exploitation can significantly impact other interconnected products in the JD Edwards ecosystem. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Attacker must reach the JD Edwards EnterpriseOne Order Promising HTTP interface over the network and possess a low-privileged authenticated account on the JD Edwards EnterpriseOne environment (PR:L), with no user interaction required. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score is 9.9 with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - a near-maximum score driven by network reachability, low attack complexity, only low privileges required, no user interaction, and a scope change with high CIA impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained or compromised a low-privileged JD Edwards EnterpriseOne user account sends crafted HTTP requests to the Order Promising Integration endpoints on the application server. Because the flaw produces a CVSS scope change, the exploitation pivots from Order Promising into other connected JD Edwards components, ultimately achieving full takeover of Order Promising and high-impact effects on adjacent modules. … |
| Remediation | Apply the patch available per Oracle's June 2026 Critical Security Patch Update for JD Edwards EnterpriseOne (https://www.oracle.com/security-alerts/cspujun2026.html); Oracle has not published an independent fix version string beyond the CSPU bundle in the available data, so administrators should install the CSPU package for the 9.2 release line. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
24 hours: Restrict Order Promising Integration network access to pre-approved trusted networks; limit user access to essential personnel only; establish incident response team readiness. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today