EUVD-2026-46978
GHSA-rm28-9ggr-6j29
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H
Network-accessible HTTP vector, but AC:H due to specific exploit conditions; low-privilege auth required; high availability loss from repeatable crash with only limited C/I leakage.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the JD Edwards EnterpriseOne Configurator product of Oracle JD Edwards (component: Configuration Management). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Configurator. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of JD Edwards EnterpriseOne Configurator as well as unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Configurator accessible data and unauthorized read access to a subset of JD Edwards EnterpriseOne Configurator accessible data. CVSS 3.1 Base Score 6.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H).
AnalysisAI
Oracle JD Edwards EnterpriseOne Configurator 9.2 exposes its Configuration Management component to a medium-severity network attack over HTTP that can cause repeated crashes or hangs alongside limited unauthorized data read and write. A low-privileged attacker who can reach the application over the network may - under high-complexity conditions - deny service to all Configurator users and access or modify a subset of configuration data. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; the high attack complexity materially reduces the likelihood of opportunistic mass exploitation.
Technical ContextAI
JD Edwards EnterpriseOne is Oracle's ERP platform targeting manufacturing, distribution, and asset-intensive industries, with the Configurator module handling product configuration rules and options used in order and manufacturing workflows. The affected component, Configuration Management, is accessible over HTTP and therefore part of the application's web tier. The CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U) points to a flaw reachable from the network by an authenticated low-privilege user, but only under specific or non-default conditions consistent with AC:H - potentially involving race conditions, specific application state, or particular request sequencing. No CWE has been assigned, so the root cause class (e.g., resource exhaustion, improper input validation, or logic flaw) is unconfirmed from available data. The impact profile - high availability loss with low confidentiality and integrity leakage - is characteristic of a resource management or error-handling weakness that collapses the service while incidentally exposing limited data.
RemediationAI
Apply Oracle's July 2026 Critical Patch Update, which addresses this vulnerability as part of Oracle's quarterly security release cycle; the advisory is available at https://www.oracle.com/security-alerts/cpujul2026.html. Exact patched build numbers for JD Edwards EnterpriseOne 9.2 should be confirmed via Oracle My Oracle Support, as CPUs are delivered through Oracle's patch management tooling rather than standalone installers. As compensating controls prior to patching, restrict HTTP access to the Configuration Management component to trusted internal network segments or enforce VPN-only access, reducing the network attack surface for the AV:N vector. Audit and minimize the set of low-privilege accounts with access to the Configurator module, since PR:L is a required exploitation condition - reducing unnecessary account access directly limits attacker opportunity. Note that network segmentation does not eliminate risk if the attacker is already on the internal network; patching remains the definitive fix.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today