What is the CVSS score of EUVD-2026-37230?

EUVD-2026-37230 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of JD Edwards EnterpriseOne are affected by EUVD-2026-37230?

Oracle JD Edwards EnterpriseOne Project Costing 9.2 is vulnerable to a critical privilege escalation flaw (CVSS 9.6) that allows authenticated network users to read, modify, or delete all project…

How to fix or mitigate EUVD-2026-37230?

24 hours: Restrict JDENET protocol access to trusted networks only; audit Project Costing 9.2 access logs for unauthorized data modifications; revoke unnecessary low-privilege account access to the Job Costing component. 7 days: Complete access control review for all users with Project Costing module permissions; implement network segmentation isolating JDENET traffic; enable continuous monitoring of cost data modifications and deletions. 30 days: Assess upgrade path to post-9.2 JD Edwards versions with vendor patches available; develop data restoration procedures; establish independent cost reconciliation controls against source documents.

JD Edwards EnterpriseOne EUVD-2026-37230

| CVE-2026-46911 CRITICAL

Improper Access Control (CWE-284)

2026-06-16 oracle

Authentication Bypass Oracle Jd Edwards Enterpriseone Project Costing

9.6

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

vuln.today AI

9.6 CRITICAL

JDENET is network-reachable (AV:N), exploitation is straightforward (AC:L), a valid low-privileged JD Edwards account is required (PR:L), no user interaction, and the flaw crosses module boundaries (S:C) with high confidentiality/integrity but no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 22:15 vuln.today

DescriptionCVE.org

Vulnerability in the JD Edwards EnterpriseOne Project Costing product of Oracle JD Edwards (component: Job Costing). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Project Costing. While the vulnerability is in JD Edwards EnterpriseOne Project Costing, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Project Costing accessible data as well as unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Project Costing accessible data. CVSS 3.1 Base Score 9.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).

AnalysisAI

Cross-product compromise in Oracle JD Edwards EnterpriseOne Project Costing 9.2 (Job Costing component) allows a low-privileged attacker with network access via the JDENET protocol to read, modify, or delete all data accessible to the Project Costing module and to impact additional adjacent products through a scope change. Oracle rates this 9.6 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) and there is no public exploit identified at time of analysis, with the issue tracked as EUVD-2026-37230.

Technical ContextAI

JD Edwards EnterpriseOne is Oracle's ERP suite, and Project Costing is the module that tracks costs, budgets, and billing across projects and jobs. Communication between EnterpriseOne components (enterprise server, HTML server, deployment server) flows over JDENET, Oracle's proprietary TCP-based middleware protocol used for kernel calls and inter-process messaging. The CPE cpe:2.3:a:oracle_corporation:jd_edwards_enterpriseone_project_costing scopes the flaw to the Project Costing application, and the scope-change (S:C) indicator combined with the Oracle-supplied 'Authentication Bypass' tag suggests the Job Costing component fails to properly enforce authorization on a JDENET-reachable function, letting an authenticated session reach data or operations belonging to other JD Edwards modules or security domains. No CWE was assigned by Oracle, but the behavior is consistent with broken access control / privilege boundary failure across a trust boundary.

RemediationAI

Apply the fixes shipped in Oracle's June 2026 Critical Patch Update for JD Edwards EnterpriseOne 9.2 as documented at https://www.oracle.com/security-alerts/cspujun2026.html; a specific patched build number was not provided in the input, so administrators should pull the exact Project Costing / Tools Release patch identifier directly from the CPU advisory and MOS notes. Until patching is complete, restrict the JDENET port (typically TCP 6015-6017 and the configured kernel ports in jde.ini) to known enterprise/HTML server hosts via host firewalls or network ACLs so untrusted clients cannot speak JDENET, accepting that this may break ad-hoc integrations or thick-client connections from unmanaged subnets. Additionally, audit and tighten JD Edwards role and security workbench entitlements for the Project Costing / Job Costing applications to minimise the population of low-privileged accounts that could trigger the flaw, recognising this is a hardening measure rather than a fix.