EUVD-2026-37226Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed JDE Order Promising endpoint
-
DeliveryObtain low-privileged JDE account
-
ExploitSend crafted HTTP request to Order Promising Integration
-
ExecutionTrigger scope-changing flaw
-
PersistExecute privileged actions across JDE components
-
ImpactTake over Order Promising and pivot to adjacent modules
Vulnerability Assessment
| Weakness |
CWE
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker must reach the JD Edwards EnterpriseOne Order Promising HTTP interface over the network and possess a low-privileged authenticated account on the JD Edwards EnterpriseOne environment (PR:L), with no user interaction required. The affected deployment must be running JD Edwards EnterpriseOne Order Promising 9.2 with the Order Promising Integration component enabled and reachable. Limiting factors that reduce realistic risk: PR:L means fully anonymous internet exploitation is not possible - the attacker needs at least a low-tier JDE credential - and exposure is bounded by whether the Order Promising Integration HTTP endpoint is reachable from attacker-controlled networks (many JDE deployments restrict it to internal or partner segments). |
| Impact | The CVSS 3.1 base score is 9.9 with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - a near-maximum score driven by network reachability, low attack complexity, only low privileges required, no user interaction, and a scope change with high CIA impact. EPSS data and SSVC decision values are not provided in the input, and the CVE is not listed in CISA KEV, so real-world exploitation pressure cannot be quantitatively confirmed. There is also no published POC at this time. However, JD Edwards is a high-value enterprise target and historically ERP advisories from Oracle CPU/CSPU cycles attract opportunistic scanning within weeks, so the absence of EPSS or KEV signals should not be treated as low risk - it should be treated as priority remediation pending the Oracle CSPU June 2026 cycle. |
| Exploit ScenarioDerived | An attacker who has obtained or compromised a low-privileged JD Edwards EnterpriseOne user account sends crafted HTTP requests to the Order Promising Integration endpoints on the application server. Because the flaw produces a CVSS scope change, the exploitation pivots from Order Promising into other connected JD Edwards components, ultimately achieving full takeover of Order Promising and high-impact effects on adjacent modules. No public exploit identified at time of analysis, but the low complexity (AC:L) and only low-privilege requirement make this attractive once details are reverse-engineered from the Oracle patch. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 16, 2026
Takeover of Oracle JD Edwards EnterpriseOne Order Promising 9.2 is possible by a low-privileged remote attacker through the Order Promising Integration component over HTTP. The flaw produces a CVSS 3.1 scope change, meaning successful exploitation can significantly impact other interconnected products in the JD Edwards ecosystem. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
RemediationAI
Apply the patch available per Oracle's June 2026 Critical Security Patch Update for JD Edwards EnterpriseOne (https://www.oracle.com/security-alerts/cspujun2026.html); Oracle has not published an independent fix version string beyond the CSPU bundle in the available data, so administrators should install the CSPU package for the 9.2 release line. As compensating controls until patching, restrict network reachability to the Order Promising Integration HTTP endpoints to known integration partners via firewall or reverse proxy ACLs, require mutual TLS or VPN for inbound integration traffic, and tighten the privileges granted to low-tier JD Edwards application accounts that can reach the integration component (acknowledging that restricting integration accounts may break upstream order-promising callers and should be validated in a staging environment first). Increase monitoring on the Order Promising Integration endpoints and on cross-component activity that could indicate scope-change exploitation against downstream JD Edwards modules.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle JD Edwards EnterpriseOne is a suite of enterprise resource planning (ERP) applications widely deployed for supply chain, manufacturing, and financial operations. The vulnerable component is the Order Promising Integration module, which exposes HTTP-accessible interfaces used to compute promised delivery dates and orchestrate cross-module workflows. CWE classification is not provided by the source, but the CVSS scope-change behavior and full CIA impact are consistent with an authorization or input-validation weakness in an integration endpoint that subsequently affects downstream JD Edwards components. The affected CPE is cpe:2.3:a:oracle_corporation:jd_edwards_enterpriseone_order_promising:*:*:*:*:*:*:*:*, with version 9.2 explicitly enumerated in the EUVD entry.
Know when Jd Edwards Enterpriseone Order Promising gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
HTTP-reachable integration endpoint (AV:N, AC:L) requires a low-privileged JDE account (PR:L), no user interaction, and Oracle explicitly states scope change with full CIA takeover.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the JD Edwards EnterpriseOne Order Promising product of Oracle JD Edwards (component: Order Promising Integration). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Order Promising. While the vulnerability is in JD Edwards EnterpriseOne Order Promising, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Order Promising. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
Executive ViewAI
Oracle JD Edwards EnterpriseOne Order Promising 9.2 contains a critical vulnerability enabling low-privileged users to gain complete system control; while no public exploit has been identified at time of analysis, the CVSS 9.9 rating and extended scope to interconnected systems create severe organizational risk. Exploitation would compromise order management operations and expose sensitive business and customer data. No vendor-released patch has been identified at this time, making immediate interim controls essential.
Until patch availability: (1) Network segmentation restricting component access to trusted internal networks and authorized personnel only; (2) authentication proxy or WAF enforcing supplemental authentication controls; (3) continuous monitoring and alerting on authentication attempts, privilege escalation, and system modifications; (4) enforce encrypted HTTPS with mutual TLS client certificate authentication; disable non-critical features; (5) maintain tested incident response procedures for rapid system isolation and recovery if compromise is detected.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
GitHub PoC
Exploit-DB