What is the CVSS score of EUVD-2026-37375?

EUVD-2026-37375 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of JD Edwards EnterpriseOne Tools are affected by EUVD-2026-37375?

Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0-9.2.26.2 are vulnerable to unauthenticated remote takeover attacks that could completely compromise the enterprise's ERP system (CVSS 9.8).

How to fix or mitigate EUVD-2026-37375?

Within 24 hours: Inventory all systems running Oracle JD Edwards EnterpriseOne Tools 9.2.0.0-9.2.26.2 and assess network accessibility of the JDENET communication channel. Within 7 days: Implement network segmentation to restrict access to affected systems from untrusted networks, enable enhanced logging and monitoring of JDENET traffic, and disable the JDENET service if operationally feasible. Within 30 days: Monitor Oracle's Critical Patch Updates and apply vendor patches immediately upon release; evaluate upgrade pathways to non-vulnerable versions if patching timelines exceed risk tolerance.

JD Edwards EnterpriseOne Tools EUVD-2026-37375

| CVE-2026-46883 CRITICAL

Improper Access Control (CWE-284)

2026-06-16 oracle

Oracle Jd Edwards Enterpriseone Tools Authentication Bypass

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

JDENET is network-reachable with no authentication or user interaction, exploitation is described as easy, and successful attack yields full Tools takeover, justifying C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 22:30 vuln.today

DescriptionCVE.org

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure Security). Supported versions that are affected are 9.2.0.0-9.2.26.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Remote takeover of Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.2 is possible by unauthenticated attackers reaching the JDENET communication channel, per Oracle's June 2026 Critical Patch Update. The CVSS 9.8 score reflects full compromise of confidentiality, integrity, and availability via a network-reachable attack path with no user interaction. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.

Technical ContextAI

JDENET is the proprietary peer-to-peer network protocol that JD Edwards EnterpriseOne Tools uses between Enterprise Servers, HTML Servers, and other middle-tier components for inter-process messaging and call-object requests. The affected component is identified by Oracle as 'Enterprise Infrastructure Security,' meaning the flaw sits in the trust/authentication boundary of this internal bus. CWE is not assigned, but the combination of unauthenticated network reach and full CIA impact is consistent with broken authentication or insecure deserialization of JDENET messages, classes of bugs historically seen in this protocol family. The CPE cpe:2.3:a:oracle_corporation:jd_edwards_enterpriseone_tools covers all 9.2.x Tools releases up to 9.2.26.2.

RemediationAI

Apply the fix shipped in Oracle's June 2026 Critical Patch Update (cspujun2026) to JD Edwards EnterpriseOne Tools; an exact fixed Tools release number was not provided in the input, so administrators should follow the patched version referenced in https://www.oracle.com/security-alerts/cspujun2026.html (Patch available per vendor advisory). Until patches are deployed, restrict JDENET ports (typically 6015 and the configured JDENET port range) to only known Enterprise Server, HTML Server, and Deployment Server hosts via host-based firewalls or network ACLs, and ensure no JDENET listener is reachable from user VLANs, DMZs, or the internet - note this can disrupt cross-server call-object traffic if scopes are too narrow. Monitor JDENET listener logs and netstat for unexpected sources, and accelerate any upgrades from older 9.2.x Tools trains that may lag the June 2026 CPU baseline.