JD Edwards EnterpriseOne CVE-2026-61272

No special conditions - remote unauthenticated exploitation over HTTP against supported JD Edwards EnterpriseOne Tools 9.2.0.0-9.2.26.4, per Oracle's 'easily exploitable' rating and the AV:N/AC:L/PR:N/UI:N vector. The only real prerequisite is network reachability to the product's web runtime (the JAS/HTML web tier); the practical limiting factor is therefore exposure - instances confined to an isolated internal network behind VPN/allow-listing are far less reachable than those exposed to the Internet or a broad corporate LAN. No authentication, no valid session, and no user interaction are required, and no non-default configuration is called out by the vendor.

Every static signal points to high real-world risk: the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N gives network reachability, low complexity, no privileges, and no user interaction, with C:H/I:H/A:H producing the maximal 9.8 base score, and Oracle explicitly labels it 'easily exploitable' resulting in 'takeover.' Counterbalancing this, dynamic signals are currently quiet - no EPSS score is provided in the input, there is no public exploit identified at time of analysis, and it is not listed in CISA KEV - so exploitation is not yet confirmed in practice; a mid-sized ERP operator should nonetheless treat internet- or intranet-exposed JD Edwards web tiers as urgent because the barrier to exploitation, once a technique surfaces, is minimal. No SSVC decision record was supplied, so automatable/technical-impact framing is inferred only from the CVSS vector (technical impact = total; likely automatable given unauthenticated HTTP). The main uncertainty is the absence of a CWE and any technical write-up, so the exact exploitation technique cannot be verified from the provided data.

An attacker who can reach the JD Edwards EnterpriseOne web interface over HTTP sends a crafted unauthenticated request to the Web Runtime SEC component and, exploiting the flaw, gains full control of the Tools instance without any credentials or user interaction. From that foothold they could read or alter ERP data (financials, HR, supply chain) and pivot into connected back-end systems. No public proof-of-concept has been identified at time of analysis, but the low attack complexity means one could be developed quickly once technical details circulate.