EUVD-2026-61347
GHSA-c3qm-rmp8-hpp2
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Requires a valid low-privileged account (PR:L); network-accessible HTTP API with no complexity barriers; no availability impact per description.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orchestrator Security). Supported versions that are affected are 9.2.0.0-9.2.26.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Orchestrator. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Orchestrator accessible data as well as unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Orchestrator accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
AnalysisAI
Unauthorized data access and manipulation in Oracle JD Edwards EnterpriseOne Orchestrator versions 9.2.0.0 through 9.2.26.4 is achievable by any low-privileged network attacker over HTTP, with no user interaction required. Tagged as an authentication bypass in the E1 IOT Orchestrator Security component, the vulnerability exposes both confidentiality and integrity of all data accessible to the Orchestrator - including critical business records - to unauthorized reads, creates, deletes, and modifications. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to hold a valid, low-privileged account within the JD Edwards EnterpriseOne system (consistent with CVSS PR:L), and the Orchestrator component must be deployed and network-accessible over HTTP - which is its standard operational mode. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) accurately reflects a high-severity flaw: network-reachable, low complexity, low privilege requirement, no user interaction, with dual high-impact confidentiality and integrity outcomes. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Oracle Critical Security Patch Update (CPU) for August 2026, available at https://www.oracle.com/security-alerts/cspuaug2026.html, which addresses this vulnerability. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Oracle JD Edwards EnterpriseOne Orchestrator deployments running versions 9.2.0.0 through 9.2.26.4, assess the sensitivity and scope of data each instance processes, and immediately restrict HTTP network access to the Orchestrator to trusted administrators only via firewall rules. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, rela
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, rela
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, rela
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, rela
In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for a
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, rela
A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. Rated high seve
A vulnerability was found in Hibernate-Validator. Rated medium severity (CVSS 6.1), this vulnerability is remotely explo
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, rela
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, rela
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, rela
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untru
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today