Jd Edwards Enterpriseone Procurement And Subcontract Management
Monthly
Full compromise of Oracle JD Edwards EnterpriseOne Procurement and Subcontract Management (version 9.2) is achievable by a low-privileged attacker with HTTP network access, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 score of 8.8 and Oracle explicitly characterizes it as 'easily exploitable,' with successful attacks resulting in complete takeover of the Procurement component (confidentiality, integrity, and availability all high). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the authenticated-yet-low-barrier profile makes it a strong patch priority for JD Edwards operators.
Full compromise of Oracle JD Edwards EnterpriseOne Procurement and Subcontract Management (version 9.2) is achievable by a low-privileged attacker with HTTP network access, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 score of 8.8 and Oracle explicitly characterizes it as 'easily exploitable,' with successful attacks resulting in complete takeover of the Procurement component (confidentiality, integrity, and availability all high). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the authenticated-yet-low-barrier profile makes it a strong patch priority for JD Edwards operators.