EUVD-2026-37371Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
JDENET is network-reachable (AV:N), Oracle calls it easily exploitable (AC:L), no auth or interaction is needed (PR:N/UI:N), and full takeover yields H/H/H within the Tools scope.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure Security). Supported versions that are affected are 9.2.0.0-9.2.26.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
AnalysisAI
Remote takeover of Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.2 is possible by unauthenticated attackers reaching the JDENET communication channel, per Oracle's June 2026 Critical Patch Update. The CVSS 9.8 vector (AV:N/AC:L/PR:N/UI:N) and Oracle's own 'easily exploitable' wording indicate trivial exploitation, with full confidentiality, integrity, and availability impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker only needs network reachability to the JDENET protocol listener on a JD Edwards EnterpriseOne Tools 9.2.0.0-9.2.26.2 server; no authentication, no user interaction, and no special non-default configuration is required per the CVSS AV:N/AC:L/PR:N/UI:N vector and Oracle's 'easily exploitable' wording. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | All available signals point to high real-world priority: the CVSS 9.8 vector is fully network-reachable, low complexity, no privileges, no user interaction, with H/H/H impact, and Oracle itself flags it 'easily exploitable' and resulting in 'takeover.' EPSS, KEV listing, and SSVC decision data are not provided in the input, so quantitative exploitation probability and automatability cannot be confirmed. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with network reachability to a JD Edwards EnterpriseOne server (for example a foothold on an internal workstation, a compromised business partner VPN, or a misconfigured perimeter exposing JDENET) sends a crafted JDENET message to the kernel listener and gains takeover of the Tools layer without any credentials or user interaction. Given Oracle's 'easily exploitable' framing and AC:L, weaponization should be assumed feasible by a skilled attacker once technical details emerge, even though no public exploit identified at time of analysis. |
| Remediation | Apply the fix delivered in Oracle's June 2026 Critical Patch Update for JD Edwards EnterpriseOne Tools as documented at https://www.oracle.com/security-alerts/cspujun2026.html; Oracle's advisory is the authoritative source for the exact patched Tools release that supersedes 9.2.26.2 - patch available per vendor advisory, exact post-9.2.26.2 fix version should be taken directly from the CPU matrix rather than assumed. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify and inventory all JD Edwards deployments; assess which systems expose JDENET to untrusted networks (external internet, DMZ, or partner connections) and immediately isolate them or restrict access to trusted internal sources only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events
The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly
In OpenSSL 1.1.0 before 1.1.0d, if a malicious server supplies bad parameters for a DHE or ECDHE key exchange then this
A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL proto
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, rela
It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. Rated critical severity (CVS
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, rela
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics)
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, rela
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, rela
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, rela
Vulnerability in the Advanced Networking Option component of Oracle Database Server. Rated high severity (CVSS 8.3), thi
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today