EUVD-2026-37223Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed JDENET listener
-
DeliverySend crafted JDENET kernel message
-
ExploitBypass Enterprise Infrastructure Security checks
-
ExecutionGain Tools-level control
-
PersistAccess ERP data and business logic
-
ImpactPersist via administrative changes
Vulnerability Assessment
| Weakness |
CWE
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker must have network reachability to the JDENET service of a JD Edwards EnterpriseOne Tools 9.2.0.0-9.2.26.2 server (typically TCP 6015 and related kernel ports on Enterprise Server, HTML Server, or Deployment Server tiers); no credentials, prior session, or user interaction are required per CVSS PR:N/UI:N. The principal limiting factor is therefore network exposure of JDENET: organizations that confine these ports to trusted EnterpriseOne hosts via firewalls, ACLs, or segmented ERP VLANs reduce exposure to insiders or anyone who has already breached the perimeter, while customers running Tools releases newer than 9.2.26.2 (post-June 2026 CPU) are out of scope. |
| Impact | All available signals point to high real-world risk: CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N with full C/I/A impact, Oracle explicitly labels the issue 'easily exploitable,' and the affected product is a widely deployed ERP system whose JDENET ports are commonly reachable inside enterprise networks. Countervailing signals are notable but limited - no EPSS score, KEV listing, or public PoC was provided, so exploitation appears not yet widespread. The CWE field is N/A and Oracle's CPU advisories typically omit technical specifics, so defenders should treat the patch as urgent on the assumption that reverse-engineering of the June 2026 CPU may yield working exploits quickly, even if mass exploitation is not yet observed. |
| Exploit ScenarioDerived | An attacker with network reach to an EnterpriseOne server - for example, a foothold on a corporate VLAN, VPN, or DMZ where JDENET ports are not strictly segmented - sends a crafted JDENET message to the Enterprise Infrastructure Security component and obtains control of the Tools instance without credentials or user interaction. From that foothold the attacker can pivot into ERP data (financials, payroll, supplier records), manipulate business transactions, or disable the platform. No public exploit identified at time of analysis, but Oracle's 'easily exploitable' wording suggests low technical barrier once details are known. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 16, 2026
Remote takeover of Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.2 is possible by unauthenticated attackers reaching the JDENET network service, yielding full confidentiality, integrity, and availability compromise of the platform. Oracle rates the issue CVSS 9.8 and describes it as easily exploitable, though no public exploit identified at time of analysis and it is not listed in CISA KEV.
RemediationAI
Apply the fixes shipped in Oracle's June 2026 Critical Patch Update for JD Edwards (https://www.oracle.com/security-alerts/cspujun2026.html); an exact patched Tools release is not enumerated in the provided data, so administrators should consult the CPU matrix to identify the post-9.2.26.2 Tools level applicable to their environment. Until the CPU is deployed, restrict network reachability of the JDENET listener (default TCP 6015 and related kernel ports) to known EnterpriseOne servers and administrative jump hosts using host firewalls or network ACLs, accepting that this will break any out-of-band integrations or remote admin tooling that currently traverse those ports. Monitor JDENET kernel logs and the Server Manager for unexpected connections, anomalous kernel call patterns, or new administrative users, and avoid exposing any EnterpriseOne tier directly to the internet.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
JD Edwards EnterpriseOne Tools is Oracle's ERP middleware tier that hosts the runtime, security kernel, and integration services for JD Edwards EnterpriseOne applications. The vulnerable component, Enterprise Infrastructure Security, is reached via JDENET - the proprietary TCP-based inter-process protocol that EnterpriseOne servers (Enterprise Server, HTML Server, Deployment Server) use to exchange kernel messages, authentication tokens, and application calls. Because the flaw is triggered through JDENET without authentication, the weakness lies in how this protocol handler validates or trusts incoming messages before invoking privileged kernel operations; Oracle has not disclosed a CWE, but the impact profile is consistent with an authentication-bypass or unsafe deserialization/command-handling weakness in the JDENET listener.
Know when Jd Edwards Enterpriseone Tools gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Oracle states unauthenticated network exploitation via JDENET with full takeover, matching AV:N/AC:L/PR:N/UI:N and C:H/I:H/A:H with unchanged scope.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure Security). Supported versions that are affected are 9.2.0.0-9.2.26.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.2 contain a critical vulnerability (CVSS 9.8) enabling unauthenticated remote system takeover with complete confidentiality, integrity, and availability compromise. No public exploit has been identified at time of analysis. No vendor-released patch has been identified at time of analysis, creating immediate risk for organizations operating affected versions.
Without vendor-released patch: (1) Network isolation-restrict JDENET service via firewall to whitelisted IP addresses and required business connections; (2) Access controls-enforce multi-factor authentication for all JD Edwards accounts and strictly limit administrative privileges; (3) Detection-deploy IDS/IPS with signatures for JDENET exploitation attempts and enable detailed transaction logging; (4) Segmentation-isolate affected systems to dedicated network segment with controlled egress filtering; (5) Incident response-establish 24/7 security operations center monitoring with documented containment and isolation procedures. These interim controls reduce attack surface but do not eliminate underlying vulnerability-patch application is essential upon vendor release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events
In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Rated cri
The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly
In OpenSSL 1.1.0 before 1.1.0d, if a malicious server supplies bad parameters for a DHE or ECDHE key exchange then this
A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL proto
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, rela
jQuery-UI is the official jQuery user interface library. Rated medium severity (CVSS 6.1), this vulnerability is remotel
An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. Rated med
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, rela
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, rela
It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. Rated critical severity (CVS
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, rela
GitHub PoC
Exploit-DB