EUVD-2026-46871
GHSA-m28m-qjfp-cpfm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege account
-
DeliveryReach HR Management over HTTP
-
ExploitSend crafted request to vulnerable function
-
ExecutionAbuse flaw to escalate
-
ImpactTake over HR module (read/modify data, disrupt)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network access to the JD Edwards EnterpriseOne Human Resources Management web application over HTTP and a valid low-privileged account on the system (CVSS PR:L, AV:N) - it is not unauthenticated. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so any authenticated low-privilege user who can reach the HR component can attempt it against version 9.2. The principal limiting factors are the authentication requirement (an attacker must first obtain valid low-privilege credentials or an active session) and network reachability of the HR interface; deployments that expose EnterpriseOne only to trusted internal users and restrict HR module access materially reduce realistic exposure. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8 High) describes a network-reachable, low-complexity attack needing only low privileges and no user interaction, with full C/I/A impact - a strong technical signal for prioritization, reinforced by Oracle's own 'easily exploitable' language. Counterbalancing this: there is no EPSS score provided, the CVE is not in CISA KEV (no confirmed active exploitation), and no public proof-of-concept is identified, so real-world exploitation pressure is currently unproven. A notable inconsistency exists between Oracle's 'Information Disclosure' tag and the vector's I:H/A:H and stated 'takeover' outcome - the tag understates impact; treat the CVSS vector and takeover description as authoritative. Because PR:L requires a valid low-privilege account, the practical attack surface is limited to users who can already authenticate to the HR application, which tempers mass-exploitation risk relative to an unauthenticated flaw. |
| Exploit ScenarioDerived | An attacker who holds or phishes a low-privilege JD Edwards EnterpriseOne user account sends crafted HTTP requests to the Human Resources Management application over the network, requiring no user interaction. By abusing the vulnerable HR function they escalate to full control of the module, reading and altering sensitive HR/PII data and disrupting the service. No public proof-of-concept is currently identified, but Oracle's low attack-complexity rating implies a reliable exploit is feasible once details are known. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 22, 2026
Product takeover in Oracle JD Edwards EnterpriseOne Human Resources Management 9.2 allows an authenticated low-privileged attacker with HTTP network access to fully compromise the Human Resources component, gaining high confidentiality, integrity, and availability impact (CVSS 3.1 8.8). Oracle rates the flaw as easily exploitable, but no public exploit identified at time of analysis and it is not listed in CISA KEV. The bug is addressed in Oracle's July 2026 Critical Patch Update.
RemediationAI
Apply the fixes in Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html), which is the vendor advisory addressing this issue for JD Edwards EnterpriseOne 9.2 - Patch available per vendor advisory (no single discrete fix version number is published in the source data beyond the CPU tools-release/ESU bundle, so consult the CPU for the exact JD Edwards tools release and ESU patch levels for your deployment). Because exploitation requires an authenticated low-privilege account, interim compensating controls until patching include restricting network access to the EnterpriseOne HR web interface to trusted internal networks or VPN (trade-off: may block legitimate remote/SSO users), tightening HR module role and menu security to reduce which low-privilege users can reach the vulnerable function, and increasing monitoring/audit logging on HR application access for anomalous privilege use. These are mitigations, not fixes; prioritize applying the CPU given the 8.8 severity and 'easily exploitable' rating.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
JD Edwards EnterpriseOne is Oracle's integrated ERP suite; the affected Human Resources Management module is a web-facing (HTTP) enterprise application typically fronted by the EnterpriseOne HTML/JAS server and backed by the platform's application and database tiers. The vulnerability is reached over the network via HTTP against the Human Resources component, and successful exploitation yields takeover of that module - meaning the attacker escalates from a low-privilege account to full control of the affected application. Oracle assigned no CWE (CWE: N/A), so the precise root-cause class (e.g., injection, access-control bypass, or deserialization) is not disclosed in the available data; Oracle's advisory tags it under Information Disclosure, though the C:H/I:H/A:H vector indicates impact well beyond disclosure alone.
Know when Jd Edwards Enterpriseone Human Resources Management gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network HTTP reach (AV:N) with low complexity (AC:L) but a required low-privilege account (PR:L), no user interaction, yielding full HR-module compromise (C/I/A:H).
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the JD Edwards EnterpriseOne Human Resources Management product of Oracle JD Edwards (component: Human Resources). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Human Resources Management. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Human Resources Management. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle JD Edwards EnterpriseOne HR Management 9.2 contains a critical vulnerability (CVE-2026-60493, CVSS 8.8) enabling authenticated users to fully compromise the HR component and access all employee and payroll data. This exposes the organization to data breach liability, operational disruption of HR processes, and potential regulatory violations affecting workforce management and compliance reporting.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated remote compromise of Oracle JD Edwards EnterpriseOne Human Resources Management 9.2 allows network attac
Full takeover of Oracle JD Edwards EnterpriseOne Human Resources Management 9.2 is possible when a low-privileged attack
Exploit-DB