What is the CVSS score of EUVD-2026-37229?

EUVD-2026-37229 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H. EPSS exploitation probability: 0.5%.

Which versions of JD Edwards EnterpriseOne Tools are affected by EUVD-2026-37229?

Any organization with Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.2 faces critical exposure to unauthenticated remote attack: adversaries can freely access sensitive…

How to fix or mitigate EUVD-2026-37229?

Within 24 hours: Identify and inventory all systems running Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.2; enable enhanced monitoring and logging on the Enterprise Infrastructure Security component for anomalous access attempts. Within 7 days: Isolate affected systems from internet exposure via network segmentation and firewall rules; contact Oracle for patch timeline and availability. Within 30 days: Implement compensating controls (enhanced authentication, strict network access controls, continuous audit logging); develop and validate upgrade plan to patched version when released by Oracle.

JD Edwards EnterpriseOne Tools EUVD-2026-37229

| CVE-2026-46910 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-06-16 oracle

Authentication Bypass Oracle Jd Edwards Enterpriseone Tools

9.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

vuln.today AI

9.1 CRITICAL

HTTP-reachable, unauthenticated, no UI per Oracle; high confidentiality and DoS impact, no integrity change, no scope change beyond the Tools tier.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 22:15 vuln.today

DescriptionCVE.org

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure Security). Supported versions that are affected are 9.2.0.0-9.2.26.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 9.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H).

AnalysisAI

Unauthenticated remote compromise in Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.2 allows network attackers to obtain unauthorized access to critical data and cause a complete denial of service via HTTP against the Enterprise Infrastructure Security component. Oracle rates this 9.1 (CVSS 3.1) reflecting high confidentiality and availability impact with no authentication or user interaction required, though no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

JD Edwards EnterpriseOne Tools is the runtime and administrative tier of Oracle's JDE ERP suite, providing the web-facing infrastructure (HTML Server, Server Manager, Enterprise Server connectivity) that fronts business logic and data for finance, HR, and supply chain modules. The flaw resides in the Enterprise Infrastructure Security component, which handles authentication, session, and access-control plumbing for HTTP-facing services. While no CWE is assigned, the tag 'Authentication Bypass' combined with a PR:N / C:H / I:N / A:H profile is consistent with a flaw that lets requests reach protected functionality without valid credentials, exposing data reads and resource-exhaustion paths but not write/integrity operations.

RemediationAI

Apply Patch available per vendor advisory - install the fixes shipped in Oracle's June 2026 Critical Patch Update at https://www.oracle.com/security-alerts/cspujun2026.html, which addresses JD Edwards EnterpriseOne Tools through 9.2.26.2; Oracle does not publish a discrete fixed version number in the public advisory, so confirm the target Tools release via My Oracle Support before scheduling. Until patching is complete, restrict HTTP and HTTPS access to JDE Tools components (HTML Server, Server Manager, JAS) to trusted management networks via firewall or reverse-proxy ACLs, place the web tier behind an authenticating reverse proxy or VPN, and disable any internet exposure of the administrative endpoints - be aware this will break partner integrations and remote employee access that rely on direct HTTP reachability. Increase monitoring on the Enterprise Infrastructure Security component logs for anomalous unauthenticated requests and sudden process hangs or crashes consistent with the DoS impact.