EUVD-2026-37375Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify reachable JDENET listener
-
DeliverySend crafted JDENET message
-
ExploitBypass infrastructure security check
-
ExecutionExecute attacker logic on Tools
-
PersistTake over EnterpriseOne Tools instance
-
ImpactPivot to ERP data and batch jobs
Vulnerability Assessment
| Weakness |
CWE
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker must have network reachability to the JDENET service of a JD Edwards EnterpriseOne Tools 9.2.0.0-9.2.26.2 Enterprise Server (default JDENET port 6015 and the configured port range); no authentication, no user interaction, and no special configuration toggles are required per Oracle's description and the AV:N/AC:L/PR:N/UI:N vector. The principal limiting factor is exposure of JDENET itself: in correctly segmented deployments JDENET is reachable only from trusted middle-tier servers, so internet- or user-VLAN-exposed Enterprise Servers are the realistic exploitation set. Tools versions outside 9.2.0.0-9.2.26.2 are out of scope. |
| Impact | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H combined with Oracle's own description of 'easily exploitable' and 'takeover' makes this a top-priority Oracle CPU item. EPSS data was not supplied, and the CVE is not on CISA KEV, so probabilistic exploitation data is unavailable; however, JDENET historically should not be internet-exposed, which materially reduces real-world attack surface relative to the raw 9.8 score for organizations following Oracle's deployment guidance. The main divergence to call out is between the network-vector CVSS and the realistic deployment posture: shops that expose JDENET ports (default 6015 and surrounding range) beyond trusted server tiers face an immediate, easily exploitable RCE/takeover risk, while well-segmented deployments face a far lower true risk. No SSVC decision, POC, or KEV signal is present in the input. |
| Exploit ScenarioDerived | An attacker with network reachability to a JD Edwards Enterprise Server's JDENET port sends crafted JDENET messages to the listener and, without supplying credentials, gains code execution or administrative control of the Tools layer, pivoting to ERP data and batch processes. No public exploit identified at time of analysis, but the AC:L/PR:N/UI:N profile means a working exploit, once written, would be point-and-click against any reachable Tools instance in the affected 9.2.0.0-9.2.26.2 range. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 16, 2026
Remote takeover of Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.2 is possible by unauthenticated attackers reaching the JDENET communication channel, per Oracle's June 2026 Critical Patch Update. The CVSS 9.8 score reflects full compromise of confidentiality, integrity, and availability via a network-reachable attack path with no user interaction. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
RemediationAI
Apply the fix shipped in Oracle's June 2026 Critical Patch Update (cspujun2026) to JD Edwards EnterpriseOne Tools; an exact fixed Tools release number was not provided in the input, so administrators should follow the patched version referenced in https://www.oracle.com/security-alerts/cspujun2026.html (Patch available per vendor advisory). Until patches are deployed, restrict JDENET ports (typically 6015 and the configured JDENET port range) to only known Enterprise Server, HTML Server, and Deployment Server hosts via host-based firewalls or network ACLs, and ensure no JDENET listener is reachable from user VLANs, DMZs, or the internet - note this can disrupt cross-server call-object traffic if scopes are too narrow. Monitor JDENET listener logs and netstat for unexpected sources, and accelerate any upgrades from older 9.2.x Tools trains that may lag the June 2026 CPU baseline.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
JDENET is the proprietary peer-to-peer network protocol that JD Edwards EnterpriseOne Tools uses between Enterprise Servers, HTML Servers, and other middle-tier components for inter-process messaging and call-object requests. The affected component is identified by Oracle as 'Enterprise Infrastructure Security,' meaning the flaw sits in the trust/authentication boundary of this internal bus. CWE is not assigned, but the combination of unauthenticated network reach and full CIA impact is consistent with broken authentication or insecure deserialization of JDENET messages, classes of bugs historically seen in this protocol family. The CPE cpe:2.3:a:oracle_corporation:jd_edwards_enterpriseone_tools covers all 9.2.x Tools releases up to 9.2.26.2.
Know when Jd Edwards Enterpriseone Tools gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
JDENET is network-reachable with no authentication or user interaction, exploitation is described as easy, and successful attack yields full Tools takeover, justifying C:H/I:H/A:H.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure Security). Supported versions that are affected are 9.2.0.0-9.2.26.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0-9.2.26.2 are vulnerable to unauthenticated remote takeover attacks that could completely compromise the enterprise's ERP system (CVSS 9.8). While no public exploit has been identified at time of analysis, the absence of an available vendor patch combined with this system's criticality to operations creates urgent risk requiring immediate mitigation.
No vendor-released patch identified at time of analysis. Interim mitigations include: (1) Network isolation-restrict JDENET channel access to trusted, internal networks only; (2) Firewall rules-block external access to JD Edwards communication ports; (3) Disable JDENET service if not required for current operations; (4) Enhanced monitoring-log and alert on all JDENET connection attempts and suspicious activity; (5) Credential rotation-reset service account credentials post-implementation of access controls.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events
In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Rated cri
The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly
In OpenSSL 1.1.0 before 1.1.0d, if a malicious server supplies bad parameters for a DHE or ECDHE key exchange then this
A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL proto
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, rela
jQuery-UI is the official jQuery user interface library. Rated medium severity (CVSS 6.1), this vulnerability is remotel
An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. Rated med
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, rela
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, rela
It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. Rated critical severity (CVS
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, rela
GitHub PoC
Exploit-DB