EUVD-2026-106547
GHSA-9p43-2w53-f5v3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged JDE account
-
DeliveryReach JDENET service over network
-
ExploitSend crafted JDENET request
-
ExecutionRead restricted data subset / degrade service
-
ImpactPartial disclosure and partial DoS
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the JDENET communication service of JD Edwards EnterpriseOne Tools and a valid low-privileged EnterpriseOne account (CVSS PR:L) - it is NOT unauthenticated. Affected builds are EnterpriseOne Tools 9.2.0.0 through 9.2.26.5. No special non-default configuration or user interaction (UI:N) is called out as a prerequisite. The principal limiting factors are the authentication requirement and the limited blast radius: only a subset of data can be read (C:L) and only a partial, not complete, denial of service (A:L) is achievable, with no integrity impact. |
| Impact | This is a moderate-severity vulnerability (CVSS 3.1 base 5.4) in Oracle JD Edwards EnterpriseOne Tools that in practice sits well below top-priority status. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L) indicates a network-exploitable, low-complexity flaw reachable via the JDENET protocol, but it requires an existing low-privileged account (PR:L), caps impact at partial confidentiality loss (C:L - a subset of accessible data) plus partial denial of service (A:L), and has no integrity impact. No EPSS score, CISA KEV listing, or public proof-of-concept was provided in the input, so there is no signal of active or probable exploitation; exploitation status is best characterized as no public exploit identified at time of analysis. Oracle's own 'easily exploitable' wording aligns with AC:L but does not elevate real-world risk given the authentication requirement and limited impact. There is no SSVC decision data supplied. In short, this is a credentialed, limited-impact issue appropriate for normal Oracle Critical Patch Update patching cadence rather than emergency response; the main caveat is that it is reachable by any authenticated JDE user, so the practical barrier is low in environments with many internal accounts. |
| Exploit ScenarioDerived | An attacker who already holds a low-privileged JD Edwards EnterpriseOne account (or has compromised one) sends crafted requests over the JDENET protocol to the EnterpriseOne Tools layer. Because attack complexity is low and no user interaction is needed, the attacker can read a subset of otherwise-restricted EnterpriseOne data and/or degrade service, causing a partial denial of service. No public proof-of-concept is known at the time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Authenticated low-privileged users of Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 can read a limited subset of application data and partially degrade service availability by sending crafted requests to the JDENET business-logic infrastructure component. The weakness is trivially reachable over the network once a valid low-privilege EnterpriseOne account exists, but its blast radius is bounded: confidentiality and availability impacts are both rated Low and there is no integrity impact, giving a CVSS 3.1 base score of 5.4. No public exploit code or confirmed active exploitation was identified at time of analysis, and no CISA KEV listing exists for this CVE.
RemediationAI
Apply the Oracle Critical Patch Update for October 2026 (https://www.oracle.com/security-alerts/cpuoct2026.html), which is the vendor remediation channel for this CVE; because the provided data does not state an exact patched Tools build, treat any release at or below 9.2.26.5 as unfixed and move to the first Tools build above 9.2.26.5 that the CPU advisory confirms as containing the fix. Until that upgrade can be scheduled, reduce exposure by segmenting JDENET so only trusted application, web, and batch tiers can reach the JDENET listener ports, which shrinks the AV:N attack surface at the cost of added firewall/ACL maintenance and possible breakage of legitimate distributed deployments or remote clients. In parallel, audit and prune low-privilege EnterpriseOne accounts and role assignments, since PR:L is the key gating factor and removing unnecessary accounts eliminates viable launch points; tighter role design may require application owners to re-validate business processes. Monitor JDENET and EnterpriseOne server logs for anomalous read patterns and request floods that would manifest as the partial denial-of-service condition, accepting that this is detection rather than prevention and generates operational noise. Patch status: patch available per vendor advisory; exact fixed version not specified in the provided data.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
JD Edwards EnterpriseOne Tools is Oracle's middleware and runtime layer for the EnterpriseOne ERP suite, and JDENET is the proprietary messaging/communications substrate that carries call-object kernel requests and session traffic between EnterpriseOne clients, web servers, and application/batch servers. The vulnerability sits in the 'Business Logic Infra SEC' component, meaning the defect is in how JDENET-exposed business logic enforces authorization and resource handling rather than in a memory-safety primitive; no CWE identifier was assigned in the source data, so the precise root-cause class (access-control gap versus unbounded resource consumption) is not formally characterized. Per the CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L, the attacker needs network reachability to the JDENET service and a valid low-privileged account, needs no user interaction, and cannot cross a scope boundary - the result is unintended read of a subset of EnterpriseOne-accessible data plus a partial denial of service, with no modification of data and no full outage. The EUVD record corroborates the affected build range as 9.2.0.0 through 9.2.26.5; no CPE identifiers were supplied, so exact platform/OS bindings rely on the vendor advisory.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
Network-reachable JDENET service (AV:N), low complexity (AC:L), requires an authenticated low-privileged account (PR:L); impacts limited to partial read (C:L) and partial DoS (A:L), no integrity.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Business Logic Infra SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 5.4 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L).
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB