EUVD-2026-106351
GHSA-p7m8-m4r3-wvc2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege JDENET credentials
-
DeliveryReach JDENET service over network
-
ExploitSend crafted request to Database and Comm SEC
-
ExecutionExploit flaw to bypass controls
-
ImpactFull takeover of EnterpriseOne Tools
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the JD Edwards EnterpriseOne JDENET service/protocol plus a valid low-privilege account (PR:L) on the affected EnterpriseOne Tools instance (supported versions 9.2.0.0 through 9.2.26.5, Database and Comm SEC component). No user interaction and no elevated privileges are needed, and attack complexity is low. The primary limiting factor is the authentication requirement - an attacker must already possess or obtain low-level credentials and be able to reach JDENET, so restricting network exposure of JDENET and tightening account provisioning materially reduce real-world risk. |
| Impact | This is a credible high-priority issue but not a drop-everything emergency. The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates network-reachable, low-complexity exploitation requiring only low-level privileges and no user interaction, resulting in full confidentiality, integrity, and availability compromise ('takeover'). Oracle's own language ('easily exploitable') aligns with the AC:L/PR:L vector. However, several escalating signals are absent from the provided data: no EPSS probability was supplied, the CVE is NOT listed in CISA KEV, and no public proof-of-concept was referenced - so there is no public exploit identified at time of analysis. The requirement for a valid (if low-privilege) account via the JDENET protocol meaningfully narrows the attacker population versus a fully unauthenticated flaw, pointing to an insider or post-foothold escalation threat rather than mass internet-facing exploitation. Net: prioritize patching for internet-exposed or widely-accessed JD Edwards deployments, but current evidence shows no active exploitation. |
| Exploit ScenarioDerived | An attacker holding low-privilege credentials for a JD Edwards EnterpriseOne environment (or who has pivoted into one) reaches the JDENET network service and sends a crafted request to the Database and Comm SEC component, achieving full takeover of the EnterpriseOne Tools instance and the sensitive ERP/financial data it manages. No user interaction is required and attack complexity is low. No public exploit code is known at time of analysis, so a working exploit would currently require independent development. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Low-privileged users who can reach the JDENET service on Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 can escalate to full takeover of the EnterpriseOne Tools instance, affecting confidentiality, integrity, and availability (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw sits in the Database and Comm SEC component, requires only network reachability plus a valid low-privilege account, and needs no user interaction or elevated rights, making attack complexity low. No public exploit code or confirmed active exploitation was identified at time of analysis, so this is a credible high-priority issue but not a drop-everything emergency; the practical constraint on attackers is possession of credentials and exposure of JDENET.
RemediationAI
Apply the fix included in the October 2026 Oracle Critical Patch Update (https://www.oracle.com/security-alerts/cpuoct2026.html); the advisory covers affected Tools releases 9.2.0.0 through 9.2.26.5, so remediation requires moving to the Tools release level prescribed by that CPU, and an exact patched version number is not independently confirmed in the available data - validate against the advisory before planning the upgrade window. Where patching must be deferred, the highest-value compensating control is to restrict network access to the JDENET listener so only known application servers, integration hosts, and administrative jump boxes can reach it; the trade-off is that overly tight ACLs break thick-client connectivity, batch integrations, and developer tooling, so scope rules by source host rather than disabling the service outright. Additionally, audit and prune low-privilege EnterpriseOne accounts and service identities, since a valid low-privilege login is a prerequisite for exploitation, and enforce strong credential hygiene to prevent credential reuse from becoming the entry point; this reduces the pool of usable accounts but adds provisioning overhead. Because exploitation yields full takeover of the Tools instance, monitor JDENET server logs and network flows for anomalous request patterns or unexpected role-elevated actions and treat any suspected compromise as a full-instance incident requiring credential rotation and integrity review of EnterpriseOne configuration and database connections.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
JD Edwards EnterpriseOne uses JDENET, Oracle's proprietary messaging/communications middleware, to carry requests between thick clients, logic servers (JDENET kernel processes), and enterprise/database servers; the 'Database and Comm SEC' component covers database security and communications security enforcement within that stack. Oracle has not published a CWE mapping or root-cause detail for this entry, but the assessed vector (network-reachable, low complexity, low privileges, no user interaction, full confidentiality/integrity/availability impact) is consistent with a missing or insufficient authorization/validation check on JDENET-handled requests, allowing an authenticated low-privileged user to act beyond their intended role against the Tools runtime. Third-party tagging classifies the entry under 'Information Disclosure', which is narrower than Oracle's own scoring of complete C/I/A compromise; the tag should be treated as incomplete metadata rather than a reliable impact bound. Because the attack surface is a proprietary middleware protocol rather than a web endpoint, visibility is typically limited to network flow data and JDENET server logs, and exploitability depends heavily on whether JDENET is reachable from untrusted network segments.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-facing JDENET with low attack complexity and no user interaction; PR:L because a low-privilege account is required, and full takeover justifies C:H/I:H/A:H with unchanged scope.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Database and Comm SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle JD Edwards EnterpriseOne Tools (versions 9.2.0.0 through 9.2.26.5) contains a high-severity privilege-escalation flaw in its Database and Comm SEC component that allows any holder of a valid low-privileged account, with nothing more than network reachability to the JDENET service, to seize full control of the EnterpriseOne Tools instance. Successful abuse would compromise the confidentiality, integrity, and availability of the ERP platform that underpins finance and supply-chain operations, exposing sensitive business data and the integrity of transactional records. Leadership should care because the barrier to exploitation is low for anyone who already holds credentials - including contractors, integration accounts, and third parties - and no vendor patch is currently available, leaving exposure management squarely in the hands of internal controls.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict JDENET network reachability via firewall rules and segmentation to trusted application/integration hosts only; enforce least privilege and unique, rotated credentials for all low-privileged accounts; monitor and alert on authentication, privilege-change, and Database and Comm SEC activity; remove or disable dormant, shared, and vendor-owned accounts; and restrict administrative access to the EnterpriseOne Tools instance to dedicated management networks.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB