EUVD-2026-106548
GHSA-2w53-53gm-r98f
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged JDE credentials
-
ExploitReach JDENET service over network
-
ExecutionSend crafted request to Business Logic Infra SEC
-
ImpactTrigger fault causing partial denial of service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the attacker to authenticate to JD Edwards EnterpriseOne Tools with a low-privileged account (PR:L) and have network access to the JDENET communication protocol/service, which is the specific feature carrying the attack. Affected builds are EnterpriseOne Tools 9.2.0.0 through 9.2.26.5. Exploitation is limited by the authentication requirement - it is not reachable by fully unauthenticated attackers - and the maximum achievable impact is a partial denial of service only; there is no confidentiality or integrity effect and no privilege escalation. |
| Impact | This is a genuine but low-priority issue. The CVSS 3.1 base score of 4.3 (MEDIUM) accurately reflects limited impact: the vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) shows network reachability over the JDENET protocol with low attack complexity and no user interaction, but it requires an authenticated low-privileged account (PR:L) and yields only a partial denial of service (A:L) with no confidentiality or integrity impact. No EPSS score, SSVC decision, KEV listing, or POC was provided in the input, so there is no public exploitation signal. There is no public exploit identified at time of analysis and the vulnerability is not on CISA KEV, so the realistic risk is modest - a disruption nuisance available only to attackers who already hold valid credentials, not a pre-auth remote takeover. The signals are internally consistent (no CVSS-vs-description conflict), so no contradictory data to flag; the main unknown is exploitation probability, which cannot be estimated because EPSS/KEV/POC data were all absent. |
| Exploit ScenarioDerived | An attacker possessing a valid low-privileged JD Edwards EnterpriseOne account sends crafted traffic to the JDENET service over the network, triggering a fault in the Business Logic Infra SEC component that partially disrupts service availability for legitimate users. No public exploit code was identified, and because confidentiality and integrity are unaffected, the outcome is limited to degraded availability rather than data theft or code execution. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
A low-privileged authenticated user with network reachability to the JDENET service can degrade availability of Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5, producing a partial denial of service against the affected component (Business Logic Infra SEC). The issue scores CVSS 3.1 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L), so there is no confidentiality or integrity impact and no privilege escalation - only a limited availability effect against the tooling itself. There is no public exploit identified at time of analysis and no CISA KEV listing; this is a genuine but low-priority issue that requires prior authentication and is best handled through the scheduled Oracle Critical Patch Update cycle.
RemediationAI
Vendor-released patch per vendor advisory: Oracle addresses this in its October 2026 Critical Patch Update, so apply the CPU to every EnterpriseOne Tools installation in the 9.2.0.0-9.2.26.5 range, following the patch matrix at https://www.oracle.com/security-alerts/cpuoct2026.html and validating the resulting Tools release level after upgrade. Where the CPU cannot be applied immediately, the effective control is to shrink the authenticated attack surface: restrict JDENET reachability so only known EnterpriseOne client and application-tier hosts can open sessions to the JDENET listener (trade-off: legitimate remote or mobile clients and any unregistered integration middleboxes will need explicit allow-listing, and misconfiguration will break logins), and audit/disable low-privileged JD Edwards accounts that do not need interactive or integration access (trade-off: service accounts used by batch or interface processes must be identified first or jobs will fail, and repeated sign-on failures will lock accounts under normal lockout policy). Monitor JDENET session logs for abnormal request volumes or repeated error storms from a single authenticated principal as an early indicator of availability abuse, noting that such monitoring adds log volume and detection tuning effort rather than preventing the attack.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
JD Edwards EnterpriseOne is Oracle's ERP suite, and its JDENET layer is the proprietary communication protocol that EnterpriseOne clients, servers, and call-object kernels use to exchange business function requests across the deployment. The affected component is classified as 'Business Logic Infra SEC', meaning the weakness sits in the authentication/security handling wrapped around that business-logic messaging path rather than in a memory-safety flaw in a public service. No CWE identifier was assigned, but the observable behavior - an authenticated, low-privileged caller causing a partial loss of availability via crafted JDENET traffic - is consistent with insufficient validation or resource handling of attacker-influenced requests inside a privileged service path. Because the attack rides on the normal authenticated JDENET channel rather than an exotic endpoint, any account that can log in and speak to the service is a viable origin for the attack, and network segmentation does not help once a session exists; only the availability of the EnterpriseOne Tools component is affected, with no read, write, or privilege gain demonstrated.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Exploitation over JDENET needs a valid low-privileged account (PR:L), is easily exploitable (AC:L) with no user interaction, and yields only partial availability loss (A:L, C:N/I:N).
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Business Logic Infra SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 4.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB