Oracle JD Edwards EnterpriseOne Tools: Privilege escalation via JDENET
Summary
A flaw in the Database and Comm SEC component of Oracle JD Edwards EnterpriseOne Tools allows an authenticated attacker with low privileges to take over the product over the network via the JDENET protocol. The vulnerability affects supported versions 9.2.0.0 to 9.2.26.5 and is rated CVSS 8.8 (high). No user interaction is required, so any user account with EnterpriseOne access is a potential attack path, and an insider is the most realistic threat.
Affected
- Oracle JD Edwards EnterpriseOne Tools, supported versions 9.2.0.0 to 9.2.26.5
- Component: Database and Comm SEC
- Attack path: JDENET network protocol
Fixed in
- Unknown. Check Oracle Critical Patch Update October 2026 advisory and Oracle patch tools for the exact fixed release.
Workaround
- No vendor workaround known for this CVE.
- Restrict JDENET access to the internal management and application network, block it from the internet and from user VLANs.
Exploitation
- No evidence of exploitation found. Not listed in CISA KEV as of 21 October 2026 (recheck recommended).
- No public proof of concept found.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
Our recommendation
- Treat as high priority within the October 2026 CPU cycle for all JD Edwards EnterpriseOne 9.2 installations.
- Confirm the exact fixed release in Oracle's advisory and apply the patch.
- Verify JDENET is not reachable from the internet, including port forwarding and firewall misconfigurations.
- Review accounts with low-privilege EnterpriseOne access.
- Monitor JDENET traffic and check the KEV catalog regularly.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Critical Patch Update October 2026 www.oracle.com
- NVD record via Vulners vulners.com
- Brandefense: Oracle October 2026 CPU brandefense.io
- SecurityOnline: Oracle CPU October 2026 securityonline.info
- NHS Digital cyber alert CC-4876 digital.nhs.uk
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 11:42.
Original description (NVD)
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Database and Comm SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.