EUVD-2026-37371Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
JDENET is network-reachable (AV:N), Oracle calls it easily exploitable (AC:L), no auth or interaction is needed (PR:N/UI:N), and full takeover yields H/H/H within the Tools scope.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure Security). Supported versions that are affected are 9.2.0.0-9.2.26.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
AnalysisAI
Remote takeover of Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.2 is possible by unauthenticated attackers reaching the JDENET communication channel, per Oracle's June 2026 Critical Patch Update. The CVSS 9.8 vector (AV:N/AC:L/PR:N/UI:N) and Oracle's own 'easily exploitable' wording indicate trivial exploitation, with full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and the issue is not yet listed in CISA KEV.
Technical ContextAI
JD Edwards EnterpriseOne Tools is the underlying technology stack (kernel, security, and middleware components) that powers Oracle's JD Edwards EnterpriseOne ERP suite, used heavily in manufacturing, distribution, and finance verticals. The affected component is Enterprise Infrastructure Security, and the attack surface is JDENET - the proprietary TCP-based inter-process communication protocol used between EnterpriseOne servers (enterprise server, HTML server, Object Configuration Manager) for kernel-to-kernel messaging. Because Oracle published no CWE and no technical detail, the exact root cause is not disclosed, but historically JDENET flaws have involved authentication bypass, deserialization, or message-parsing memory corruption on the kernel listener. The single affected CPE (cpe:2.3:a:oracle_corporation:jd_edwards_enterpriseone_tools) confirms only the Tools layer is in scope, not application modules.
RemediationAI
Apply the fix delivered in Oracle's June 2026 Critical Patch Update for JD Edwards EnterpriseOne Tools as documented at https://www.oracle.com/security-alerts/cspujun2026.html; Oracle's advisory is the authoritative source for the exact patched Tools release that supersedes 9.2.26.2 - patch available per vendor advisory, exact post-9.2.26.2 fix version should be taken directly from the CPU matrix rather than assumed. Until patching, restrict JDENET TCP ports (typically 6014-6017 range, but verify per deployment) to only known EnterpriseOne server peers using host firewalls or network ACLs, and ensure no JDENET listener is reachable from user VLANs, DMZs, or the internet - the trade-off is that misconfigured ACLs will break legitimate kernel-to-kernel calls and silently degrade ERP functionality. Monitor JDENET listener logs for anomalous connections from unexpected source IPs as a detection compensating control.
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events
The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly
In OpenSSL 1.1.0 before 1.1.0d, if a malicious server supplies bad parameters for a DHE or ECDHE key exchange then this
A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL proto
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, rela
jQuery-UI is the official jQuery user interface library. Rated medium severity (CVSS 6.1), this vulnerability is remotel
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, rela
It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. Rated critical severity (CVS
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, rela
jQuery-UI is the official jQuery user interface library. Rated medium severity (CVSS 6.1), this vulnerability is remotel
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics)
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, rela
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today