Jd Edwards Enterpriseone Hcm Foundation
Monthly
Full application takeover in Oracle JD Edwards EnterpriseOne HCM Foundation 9.2 (Time Accounting and HRM Base component) allows an authenticated, low-privileged attacker to compromise the product over HTTP. Per the CVSS vector (PR:L), a valid low-privilege account is required and exploitation is difficult (AC:H), but success yields high confidentiality, integrity, and availability impact — effectively total compromise of the HCM Foundation instance. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was disclosed in the Oracle July 2026 Critical Patch Update.
Denial-of-service and information disclosure in Oracle JD Edwards EnterpriseOne HCM Foundation 9.2 (OW HR PR Foundation component) allows a low-privileged, authenticated attacker with network/HTTP access to hang or repeatedly crash the application (complete DoS) and read a subset of accessible data. Oracle rates it CVSS 3.1 7.1 and describes it as 'easily exploitable.' There is no public exploit identified at time of analysis and it is not listed in CISA KEV; no EPSS score was supplied.
Full application takeover in Oracle JD Edwards EnterpriseOne HCM Foundation 9.2 (Time Accounting and HRM Base component) allows an authenticated, low-privileged attacker to compromise the product over HTTP. Per the CVSS vector (PR:L), a valid low-privilege account is required and exploitation is difficult (AC:H), but success yields high confidentiality, integrity, and availability impact — effectively total compromise of the HCM Foundation instance. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was disclosed in the Oracle July 2026 Critical Patch Update.
Denial-of-service and information disclosure in Oracle JD Edwards EnterpriseOne HCM Foundation 9.2 (OW HR PR Foundation component) allows a low-privileged, authenticated attacker with network/HTTP access to hang or repeatedly crash the application (complete DoS) and read a subset of accessible data. Oracle rates it CVSS 3.1 7.1 and describes it as 'easily exploitable.' There is no public exploit identified at time of analysis and it is not listed in CISA KEV; no EPSS score was supplied.