What is the CVSS score of EUVD-2026-37224?

EUVD-2026-37224 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of JD Edwards EnterpriseOne Tools are affected by EUVD-2026-37224?

Oracle JD Edwards EnterpriseOne Tools (versions 9.2.0.0-9.2.26.2) is vulnerable to complete remote takeover without authentication, exposing all ERP data and operations to compromise.

How to fix or mitigate EUVD-2026-37224?

Within 24 hours: Identify all systems running Oracle JD Edwards EnterpriseOne Tools 9.2.0.0-9.2.26.2 and document their network exposure. Within 7 days: Implement network-layer compensating controls (restrict HTTP/HTTPS access to authorized IP ranges only, deploy WAF in front of Web Runtime Security endpoints, disable unnecessary services). Within 30 days: Monitor Oracle's security advisories for patch availability and finalize upgrade strategy to a patched version.

JD Edwards EnterpriseOne Tools EUVD-2026-37224

| CVE-2026-46905 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-06-16 oracle

Oracle Jd Edwards Enterpriseone Tools Authentication Bypass

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle states unauthenticated HTTP access yields full product takeover, so AV:N/AC:L/PR:N/UI:N with C/I/A:H; scope unchanged as compromise is confined to the Tools instance itself.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 22:18 vuln.today

DescriptionCVE.org

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime Security). Supported versions that are affected are 9.2.0.0-9.2.26.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Remote unauthenticated takeover of Oracle JD Edwards EnterpriseOne Tools (versions 9.2.0.0 through 9.2.26.2) is possible via the Web Runtime Security component over HTTP, with CVSS 9.8 indicating full compromise of confidentiality, integrity, and availability. No public exploit identified at time of analysis, but the trivial attack complexity and unauthenticated network vector make this a high-priority patching target for any organization running this ERP suite. Oracle disclosed it in the June 2026 Critical Patch Update (CPU).

Technical ContextAI

JD Edwards EnterpriseOne Tools is the runtime and administration layer (HTML Server, Server Manager, web client) that sits in front of the EnterpriseOne ERP application suite - typically deployed as Java-based web tiers reachable from internal user networks or, in many real deployments, exposed via reverse proxies for remote/partner access. The vulnerable component is identified as 'Web Runtime Security', which governs request handling and authentication enforcement for the web tier. Oracle did not publish a CWE and the advisory uses the standard CPU template wording 'takeover'; combined with PR:N/UI:N this language in past Oracle CPUs has typically mapped to authentication bypass or unauthenticated remote code execution in the HTTP request handling path, but the exact root cause class is not disclosed publicly. The single CPE 'cpe:2.3:a:oracle_corporation:jd_edwards_enterpriseone_tools' confirms the Tools layer is in scope rather than the underlying business applications or database.

RemediationAI

Apply the fix delivered in the Oracle Critical Patch Update of June 2026 by upgrading JD Edwards EnterpriseOne Tools to the post-9.2.26.2 release identified in the CPU advisory at https://www.oracle.com/security-alerts/cspujun2026.html (Oracle distributes Tools patches via My Oracle Support - verify the exact target release in the CPU patch availability table). Until the upgrade can be scheduled, restrict network reachability of the EnterpriseOne HTML Server, Server Manager Console, and any other Tools web endpoints to a trusted management VLAN or VPN, and place a WAF or reverse proxy in front of any internet-exposed instance with strict allow-listing of expected URI paths - be aware these network controls do not address insider or compromised-workstation threats and may break legitimate partner integrations that rely on direct HTTP access. Increase logging on the web tier and review access logs for anomalous unauthenticated requests to administrative paths in the interim.