EUVD-2026-37224Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed JDE Tools web endpoint
-
DeliverySend crafted unauthenticated HTTP request
-
ExploitExploit Web Runtime Security flaw
-
ExecutionAchieve product takeover
-
PersistAccess ERP data and sessions
-
ImpactPivot to EnterpriseOne app/DB tier
Vulnerability Assessment
| Weakness |
CWE
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker needs only HTTP/HTTPS network reachability to a JD Edwards EnterpriseOne Tools web endpoint (HTML Server, Server Manager, or related Tools web component) running version 9.2.0.0 through 9.2.26.2; no credentials, no user interaction, and no special client configuration are required per the CVSS vector AV:N/AC:L/PR:N/UI:N. The practical limiting factor is exposure rather than technical prerequisites: deployments where the Tools web tier is confined to an internal management network or behind a VPN substantially raise the bar, whereas any instance reachable from the internet or from a broad user-access VLAN is directly exploitable. Versions outside the 9.2.0.0-9.2.26.2 range, and EnterpriseOne Applications modules (as opposed to Tools), are not in scope of this CVE. |
| Impact | All available signals point in the same direction: CVSS 9.8 with AV:N/AC:L/PR:N/UI:N is the maximum-exposure profile, and Oracle's own advisory text explicitly calls it 'easily exploitable' and capable of full product 'takeover'. No EPSS score, KEV listing, or public POC was provided in the input, so widespread mass-exploitation has not been demonstrated yet - but Oracle CPU disclosures are routinely reverse-engineered by researchers within weeks of release, and EnterpriseOne Tools is an attractive target because it fronts ERP data (financials, HR, supply chain). The main caveat is exposure: many JDE Tools deployments sit on internal networks behind a VPN, which materially lowers practical risk, but any internet-exposed HTML Server or Server Manager instance should be treated as urgent. No conflicting signals are present in the supplied data. |
| Exploit ScenarioDerived | An attacker who can reach the JD Edwards EnterpriseOne Tools web tier over HTTP - for example via an internet-exposed HTML Server, a compromised user workstation on the corporate LAN, or a partner-extranet - sends a crafted request to the Web Runtime Security component without supplying any credentials. Because the flaw is unauthenticated and low-complexity, a single request can yield full takeover of the Tools instance, enabling the attacker to manipulate sessions, exfiltrate ERP data, or pivot into the EnterpriseOne application and database tiers. No public exploit identified at time of analysis, but the CPU disclosure provides enough hints for capable researchers to develop one. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 16, 2026
Remote unauthenticated takeover of Oracle JD Edwards EnterpriseOne Tools (versions 9.2.0.0 through 9.2.26.2) is possible via the Web Runtime Security component over HTTP, with CVSS 9.8 indicating full compromise of confidentiality, integrity, and availability. No public exploit identified at time of analysis, but the trivial attack complexity and unauthenticated network vector make this a high-priority patching target for any organization running this ERP suite. Oracle disclosed it in the June 2026 Critical Patch Update (CPU).
RemediationAI
Apply the fix delivered in the Oracle Critical Patch Update of June 2026 by upgrading JD Edwards EnterpriseOne Tools to the post-9.2.26.2 release identified in the CPU advisory at https://www.oracle.com/security-alerts/cspujun2026.html (Oracle distributes Tools patches via My Oracle Support - verify the exact target release in the CPU patch availability table). Until the upgrade can be scheduled, restrict network reachability of the EnterpriseOne HTML Server, Server Manager Console, and any other Tools web endpoints to a trusted management VLAN or VPN, and place a WAF or reverse proxy in front of any internet-exposed instance with strict allow-listing of expected URI paths - be aware these network controls do not address insider or compromised-workstation threats and may break legitimate partner integrations that rely on direct HTTP access. Increase logging on the web tier and review access logs for anomalous unauthenticated requests to administrative paths in the interim.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
JD Edwards EnterpriseOne Tools is the runtime and administration layer (HTML Server, Server Manager, web client) that sits in front of the EnterpriseOne ERP application suite - typically deployed as Java-based web tiers reachable from internal user networks or, in many real deployments, exposed via reverse proxies for remote/partner access. The vulnerable component is identified as 'Web Runtime Security', which governs request handling and authentication enforcement for the web tier. Oracle did not publish a CWE and the advisory uses the standard CPU template wording 'takeover'; combined with PR:N/UI:N this language in past Oracle CPUs has typically mapped to authentication bypass or unauthenticated remote code execution in the HTTP request handling path, but the exact root cause class is not disclosed publicly. The single CPE 'cpe:2.3:a:oracle_corporation:jd_edwards_enterpriseone_tools' confirms the Tools layer is in scope rather than the underlying business applications or database.
Know when Jd Edwards Enterpriseone Tools gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Oracle states unauthenticated HTTP access yields full product takeover, so AV:N/AC:L/PR:N/UI:N with C/I/A:H; scope unchanged as compromise is confined to the Tools instance itself.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime Security). Supported versions that are affected are 9.2.0.0-9.2.26.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle JD Edwards EnterpriseOne Tools (versions 9.2.0.0-9.2.26.2) is vulnerable to complete remote takeover without authentication, exposing all ERP data and operations to compromise. The Web Runtime Security flaw allows attackers to gain full system access over HTTP, potentially affecting payroll, inventory, financials, and supply chain operations across the entire enterprise. Organizations running these versions face immediate business continuity and compliance risk.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Network isolation-restrict all HTTP/HTTPS access to JD Edwards systems to trusted internal IP ranges only via firewall ACLs; (2) Web Application Firewall-deploy WAF to detect and block exploitation attempts against the Web Runtime Security component; (3) Enhanced logging-enable audit logging for all ERP authentication and module access, with real-time alerting for anomalies; (4) Temporary isolation-consider network air-gapping of production JD Edwards systems from external connectivity if operationally feasible; (5) Vendor monitoring-subscribe to Oracle Critical Patch Update notifications and establish patch deployment timeline upon release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events
In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Rated cri
The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly
In OpenSSL 1.1.0 before 1.1.0d, if a malicious server supplies bad parameters for a DHE or ECDHE key exchange then this
A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL proto
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, rela
jQuery-UI is the official jQuery user interface library. Rated medium severity (CVSS 6.1), this vulnerability is remotel
An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. Rated med
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, rela
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, rela
It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. Rated critical severity (CVS
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, rela
GitHub PoC
Exploit-DB