Description
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: E1 Dev Platform Tech - UNIX). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
Published: 2026-10-20
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Apply Patch
AI Analysis

Impact

The JD Edwards EnterpriseOne Tools product contains a flaw that lets a low‑privileged network user trigger a hang or crash of the application without user interaction. The vulnerability is reachable through a JDENET connection and, when successful, causes a complete denial of service, preventing legitimate users from using the tools. The weakness involves resource exhaustion (CWE‑400).

Affected Systems

Oracle JD Edwards EnterpriseOne Tools (E1 Dev Platform Tech – UNIX) versions 9.2.0.0 through 9.2.26.5 are affected. Any installation lacking the official patch for this version range is at risk.

Risk and Exploitability

The CVSS 3.1 base score of 6.5 indicates a moderate severity with availability impact, low privilege and low authentication requirements. The EPSS score is 0.00289, indicating a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, yet the attack vector is remote over JDENET and can be carried out from unprivileged accounts, resulting in a repeatable crash that knocks the service offline.

Generated by OpenCVE AI on October 29, 2026 at 00:26 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the vendor‑supplied patch available through Oracle’s October 2026 security alert
  • Configure firewall rules to restrict JDENET traffic to trusted hosts or block it entirely if JDENET is not required
  • Configure Entity‑Level access controls to limit JDENET connectivity to privileged users or service accounts

Generated by OpenCVE AI on October 29, 2026 at 00:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 29 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
Title Resource Exhaustion Vulnerability in JD Edwards EnterpriseOne Tools Causes Denial of Service

Wed, 28 Oct 2026 23:30:00 +0000

Type Values Removed Values Added
Title Denial of Service in JD Edwards EnterpriseOne Tools via JDENET
Weaknesses CWE-20

Wed, 28 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-400
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 09:30:00 +0000

Type Values Removed Values Added
Title Denial of Service in JD Edwards EnterpriseOne Tools via JDENET
Weaknesses CWE-20

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: E1 Dev Platform Tech - UNIX). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
First Time appeared Oracle
Oracle jd Edwards Enterpriseone Tools
CPEs cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle jd Edwards Enterpriseone Tools
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Oracle Jd Edwards Enterpriseone Tools
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-28T19:55:45.933Z

Reserved: 2026-09-14T22:10:16.622Z

Link: CVE-2026-91284

cve-icon Vulnrichment

Updated: 2026-10-28T19:55:40.394Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:20:29.853

Modified: 2026-11-02T16:31:27.040

Link: CVE-2026-91284

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-29T00:30:14Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption