EUVD-2026-37229Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed JDE Tools HTTP endpoint
-
DeliverySend crafted unauthenticated HTTP request
-
ExploitBypass Enterprise Infrastructure Security checks
-
ExecutionRead sensitive ERP data or trigger crash
-
ImpactExfiltrate data or sustain DoS
Vulnerability Assessment
| Weakness |
CWE
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires only network HTTP reachability to a JD Edwards EnterpriseOne Tools 9.2.0.0-9.2.26.2 deployment exposing the Enterprise Infrastructure Security component (typically the HTML Server / JAS or Server Manager web tier); no credentials, no user interaction, and no non-default configuration are called out by Oracle. The practical limiter is network exposure: organizations that keep the JDE Tools web tier on an internal management VLAN, behind a VPN, or fronted by an authenticating reverse proxy materially shrink the attackable surface, while internet-exposed or partner-extranet deployments are at full CVSS-rated risk. |
| Impact | All available signals point to high real-world risk: CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N is the worst-case exposure profile (internet-reachable, no auth, no user interaction, low complexity), and the affected product is a high-value ERP infrastructure tier often exposed to intranets or partner networks. EPSS score and percentile are not provided in the input, and the CVE is not listed in CISA KEV, so exploitation telemetry is unavailable. No public PoC has been observed yet, but Oracle Critical Patch Updates historically attract reverse-engineering within days of release, and the 'easily exploitable' wording from Oracle plus the Authentication Bypass tag suggest weaponization is plausible; absence of KEV/EPSS data should not be read as low risk for an externally reachable JDE Tools deployment. |
| Exploit ScenarioDerived | An attacker on the internet, or on a flat corporate network with route to the JDE HTML Server, sends a crafted HTTP request to the Enterprise Infrastructure Security component without supplying credentials. The request bypasses authentication to read sensitive ERP data accessible to Tools (financial records, employee data, supplier information) and can also be sent in a form that triggers a repeatable hang or crash, taking the JDE Tools tier offline for all users. No PoC is public yet, but the Oracle 'easily exploitable' label and the AV:N/AC:L/PR:N/UI:N vector imply a single-shot HTTP exploit is realistic once researchers diff the CPU patch. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 16, 2026
Unauthenticated remote compromise in Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.2 allows network attackers to obtain unauthorized access to critical data and cause a complete denial of service via HTTP against the Enterprise Infrastructure Security component. Oracle rates this 9.1 (CVSS 3.1) reflecting high confidentiality and availability impact with no authentication or user interaction required, though no public exploit identified at time of analysis and it is not listed in CISA KEV.
RemediationAI
Apply Patch available per vendor advisory - install the fixes shipped in Oracle's June 2026 Critical Patch Update at https://www.oracle.com/security-alerts/cspujun2026.html, which addresses JD Edwards EnterpriseOne Tools through 9.2.26.2; Oracle does not publish a discrete fixed version number in the public advisory, so confirm the target Tools release via My Oracle Support before scheduling. Until patching is complete, restrict HTTP and HTTPS access to JDE Tools components (HTML Server, Server Manager, JAS) to trusted management networks via firewall or reverse-proxy ACLs, place the web tier behind an authenticating reverse proxy or VPN, and disable any internet exposure of the administrative endpoints - be aware this will break partner integrations and remote employee access that rely on direct HTTP reachability. Increase monitoring on the Enterprise Infrastructure Security component logs for anomalous unauthenticated requests and sudden process hangs or crashes consistent with the DoS impact.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
JD Edwards EnterpriseOne Tools is the runtime and administrative tier of Oracle's JDE ERP suite, providing the web-facing infrastructure (HTML Server, Server Manager, Enterprise Server connectivity) that fronts business logic and data for finance, HR, and supply chain modules. The flaw resides in the Enterprise Infrastructure Security component, which handles authentication, session, and access-control plumbing for HTTP-facing services. While no CWE is assigned, the tag 'Authentication Bypass' combined with a PR:N / C:H / I:N / A:H profile is consistent with a flaw that lets requests reach protected functionality without valid credentials, exposing data reads and resource-exhaustion paths but not write/integrity operations.
Know when Jd Edwards Enterpriseone Tools gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
HTTP-reachable, unauthenticated, no UI per Oracle; high confidentiality and DoS impact, no integrity change, no scope change beyond the Tools tier.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure Security). Supported versions that are affected are 9.2.0.0-9.2.26.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 9.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H).
Executive ViewAI
Any organization with Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.2 faces critical exposure to unauthenticated remote attack: adversaries can freely access sensitive enterprise financial and operational data, and completely disable mission-critical systems, without credentials. The impact spans data confidentiality, system availability, and potential regulatory consequences for affected organizations.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict network access to Enterprise Infrastructure Security component via firewall/WAF rules to authorized users only; implement enhanced authentication mechanisms and role-based access controls; enable comprehensive audit logging for all transactions and access attempts; consider operational isolation of non-critical JD Edwards instances until patched version becomes available; establish incident response procedures to detect and respond rapidly to exploitation attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events
In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Rated cri
The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly
In OpenSSL 1.1.0 before 1.1.0d, if a malicious server supplies bad parameters for a DHE or ECDHE key exchange then this
A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL proto
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, rela
jQuery-UI is the official jQuery user interface library. Rated medium severity (CVSS 6.1), this vulnerability is remotel
An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. Rated med
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, rela
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, rela
It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. Rated critical severity (CVS
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, rela
GitHub PoC
Exploit-DB