EUVD-2026-46871
GHSA-m28m-qjfp-cpfm
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network HTTP reach (AV:N) with low complexity (AC:L) but a required low-privilege account (PR:L), no user interaction, yielding full HR-module compromise (C/I/A:H).
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the JD Edwards EnterpriseOne Human Resources Management product of Oracle JD Edwards (component: Human Resources). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Human Resources Management. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Human Resources Management. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
AnalysisAI
Product takeover in Oracle JD Edwards EnterpriseOne Human Resources Management 9.2 allows an authenticated low-privileged attacker with HTTP network access to fully compromise the Human Resources component, gaining high confidentiality, integrity, and availability impact (CVSS 3.1 8.8). Oracle rates the flaw as easily exploitable, but no public exploit identified at time of analysis and it is not listed in CISA KEV. The bug is addressed in Oracle's July 2026 Critical Patch Update.
Technical ContextAI
JD Edwards EnterpriseOne is Oracle's integrated ERP suite; the affected Human Resources Management module is a web-facing (HTTP) enterprise application typically fronted by the EnterpriseOne HTML/JAS server and backed by the platform's application and database tiers. The vulnerability is reached over the network via HTTP against the Human Resources component, and successful exploitation yields takeover of that module - meaning the attacker escalates from a low-privilege account to full control of the affected application. Oracle assigned no CWE (CWE: N/A), so the precise root-cause class (e.g., injection, access-control bypass, or deserialization) is not disclosed in the available data; Oracle's advisory tags it under Information Disclosure, though the C:H/I:H/A:H vector indicates impact well beyond disclosure alone.
RemediationAI
Apply the fixes in Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html), which is the vendor advisory addressing this issue for JD Edwards EnterpriseOne 9.2 - Patch available per vendor advisory (no single discrete fix version number is published in the source data beyond the CPU tools-release/ESU bundle, so consult the CPU for the exact JD Edwards tools release and ESU patch levels for your deployment). Because exploitation requires an authenticated low-privilege account, interim compensating controls until patching include restricting network access to the EnterpriseOne HR web interface to trusted internal networks or VPN (trade-off: may block legitimate remote/SSO users), tightening HR module role and menu security to reduce which low-privilege users can reach the vulnerable function, and increasing monitoring/audit logging on HR application access for anomalous privilege use. These are mitigations, not fixes; prioritize applying the CPU given the 8.8 severity and 'easily exploitable' rating.
Unauthenticated remote compromise of Oracle JD Edwards EnterpriseOne Human Resources Management 9.2 allows network attac
Full takeover of Oracle JD Edwards EnterpriseOne Human Resources Management 9.2 is possible when a low-privileged attack
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today