JD Edwards EnterpriseOne Tools EUVD-2026-37372

The attacker must have network reachability to the JDENET service of a JD Edwards EnterpriseOne Tools server running 9.2.0.0-9.2.26.2; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no user interaction, and no special configuration are required beyond a default JDENET-enabled deployment. Limiting factors are therefore environmental rather than technical: organizations that segment JDENET ports away from general user VLANs, place EnterpriseOne servers behind internal firewalls, or restrict the kernel port range to known JDE hosts materially reduce exposure, while any deployment where JDENET is reachable from a broad user network - or, worst case, the internet - is exploitable as shipped.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H plus Oracle's own 'easily exploitable' wording places this at the top of the priority list for any organization running JD Edwards. There is no EPSS, KEV, or POC signal in the supplied data, so the threat is currently theoretical rather than observed - but JDENET is typically network-reachable from internal ERP clients and integration servers, making the attack surface large wherever the port is not segmented. Two data caveats apply: KEV status is not provided (so 'no public exploit identified' may simply reflect the recency of the June 2026 CPU), and CWE is N/A which limits root-cause certainty. Treat this as a high-priority patch even without exploitation evidence, because the combination of unauthenticated network reach plus full CIA impact on an ERP middleware layer is the profile attackers actively hunt after Oracle CPUs drop.

An attacker with TCP reach to a JD Edwards EnterpriseOne server - for example a foothold on any internal workstation, a compromised business-partner VPN, or an inadvertently exposed JDENET port - sends crafted JDENET protocol messages to the Enterprise Infrastructure Security component without supplying valid credentials. Because the flaw allows unauthenticated takeover of the Tools tier, the attacker pivots into running EnterpriseOne kernel operations, manipulating ERP transactions, and accessing financial and HR data backed by the database. No public exploit code is identified at time of analysis, but Oracle's 'easily exploitable' rating implies low engineering cost once the protocol path is understood.