EUVD-2026-106538
GHSA-x85w-6v6j-4657
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged JDENET credentials
-
DeliveryReach EnterpriseOne Tools over network
-
ExploitSend crafted JDENET request
-
ExecutionTrigger hang or repeatable crash
-
ImpactComplete denial of service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network access to the JDENET service of JD Edwards EnterpriseOne Tools AND possession of low-privileged valid credentials (PR:L) - it is not anonymous/unauthenticated. The affected component is specifically E1 Dev Platform Tech on UNIX in Tools versions 9.2.0.0 through 9.2.26.5. No user interaction is needed (UI:N). The primary limiting factors are the authentication requirement (an attacker must already have a valid low-level account or session) and network reachability of the JDENET protocol port; deployments that restrict JDENET to trusted internal networks substantially reduce exposure. Impact is confined to availability (service hang/crash) with no data compromise. |
| Impact | This is a moderate-priority availability vulnerability, not a critical emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) indicates network-reachable, low-complexity exploitation requiring only low privileges and no user interaction, but the impact is strictly availability (A:H) - a complete denial of service with no confidentiality or integrity loss. Oracle characterizes it as 'easily exploitable,' which is consistent with AC:L. However, exploitation status is 'no public exploit identified at time of analysis': no EPSS score, KEV listing, or POC was provided in the input, so there is no evidence of active exploitation or widespread weaponization. The PR:L requirement means an attacker must already hold valid low-level credentials or an authenticated JDENET session, which meaningfully narrows the realistic threat to insiders or attackers who have already gained a foothold, rather than anonymous internet-wide attackers. Net assessment: a legitimate patch-in-normal-cycle item for exposed JD Edwards deployments, elevated for internet-facing or multi-tenant JDENET instances, but not a drop-everything issue absent any exploitation signal. |
| Exploit ScenarioDerived | An attacker holding low-privileged but valid JD Edwards EnterpriseOne credentials sends a crafted request over the JDENET network protocol to a reachable EnterpriseOne Tools server. The malformed request triggers a hang or repeatable crash in the E1 Dev Platform Tech (UNIX) component, producing a complete denial of service for all users of that instance. No public exploit code was identified in the provided data, and the attack delivers no data access or code execution - only service disruption. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Authenticated low-privileged attackers with network reachability to the JDENET service can crash or repeatedly hang Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 (E1 Dev Platform Tech on UNIX), producing a complete denial of service. The CVSS 3.1 score is 6.5, with impact confined to availability (A:H) and no confidentiality or integrity effect; exploitation requires valid low-privileged credentials (PR:L) and no user interaction (UI:N). No public exploit code identified at time of analysis, and the CVE is not reported in CISA KEV; EPSS was not supplied.
RemediationAI
Patch status per the supplied references is 'Patch available per vendor advisory': apply the Oracle Critical Patch Update for October 2026 (https://www.oracle.com/security-alerts/cpuoct2026.html) and confirm the minimum fixed JD Edwards EnterpriseOne Tools release in that advisory before upgrading, since the exact patched Tools version is not stated in the input data. Until the update is applied, reduce exposure by restricting network access to the JDENET listener so that only trusted EnterpriseOne application servers, clients, and administrative hosts can reach it - this substantially lowers risk but requires accurate allowlists and can disrupt distributed or remote-office deployments if scoped too narrowly. Enforce least privilege and review which accounts hold valid low-privileged sessions, because exploitation requires authentication; removing unnecessary accounts and tightening account provisioning reduces the attacker pool but does not eliminate the flaw. Monitor JD Edwards logs and service health for repeated crashes or hangs of the E1 Dev Platform Tech processes as an indicator of attempted denial of service, and treat such events as potential exploitation attempts requiring containment.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
JD Edwards EnterpriseOne Tools provides the runtime and development platform for EnterpriseOne, and JDENET is the proprietary network protocol used for communication between EnterpriseOne clients, application servers, and middleware. The affected component is specifically E1 Dev Platform Tech on UNIX in Tools versions 9.2.0.0 through 9.2.26.5, meaning the defect is reachable over the JDENET listener by a user who already holds a valid low-privileged account or session. The supplied data does not assign a CWE (CWE: N/A), so the precise root-cause class - for example, resource exhaustion versus improper handling of malformed JDENET requests - cannot be confirmed from the available information. The assessed CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) confirms that the demonstrated consequence is availability loss through hang or repeatable crash, not code execution, data disclosure, or modification.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
JDENET is network-reachable (AV:N) with easy, authenticated low-privilege access (AC:L, PR:L) and no user interaction; impact is DoS only, so C:N/I:N/A:H.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: E1 Dev Platform Tech - UNIX). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB