CVE-2026-91284 in JD Edwards EnterpriseOne Tools
Summary
by MITRE • 10/21/2026
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: E1 Dev Platform Tech - UNIX). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the E1 Dev Platform Tech component of Oracle JD Edwards EnterpriseOne Tools, specifically affecting versions ranging from 9.2.0.0 through 9.2.26.5 on UNIX operating systems. This security flaw is characterized by its susceptibility to exploitation via network access using the JDENET protocol, which serves as a primary communication channel for the application suite. The nature of this vulnerability allows an attacker with low privileges and valid network connectivity to trigger severe stability issues within the target system. While the initial assessment might suggest broader risks due to the privileged context often associated with enterprise resource planning platforms, the specific impact vector here is strictly limited to availability rather than confidentiality or integrity breaches.
From a technical perspective, the core issue manifests as an ability to induce a hang or cause frequent, repeatable crashes of the JD Edwards EnterpriseOne Tools service. This behavior aligns closely with CWE-400, which describes conditions where resources are not properly controlled, leading to resource exhaustion. In this context, the application likely fails to handle specific malformed inputs or edge cases within the JDENET protocol processing logic, resulting in a state where the process becomes unresponsive or terminates unexpectedly. The requirement for low privileges indicates that authentication is necessary before exploitation can occur, which mitigates remote code execution risks but does not eliminate the threat of denial-of-service attacks from authenticated users with minimal access rights.
The operational impact of this vulnerability is significant due to its direct effect on system availability. A successful exploit results in a complete denial of service, effectively halting operations for any user attempting to interact with the affected JD Edwards EnterpriseOne Tools instance during the outage period. For organizations relying on continuous uptime for critical business processes such as supply chain management or financial reporting, even brief interruptions can lead to productivity losses and operational disruptions. The CVSS 3.1 base score of 6.5 reflects this moderate severity, emphasizing that while the vulnerability does not compromise data integrity or allow unauthorized access to sensitive information, it poses a substantial risk to business continuity by rendering essential services inaccessible through simple crash-inducing actions.
In terms of threat classification and mitigation strategies, this incident maps to ATT&CK technique T1499, specifically Endpoint Denial of Service, where an adversary disrupts the availability of a target system or network resource. Defense-in-depth measures should prioritize patching the affected JD Edwards EnterpriseOne Tools versions as soon as Oracle releases official updates addressing this flaw. Additionally, organizations should review access controls to ensure that only essential personnel have low-privileged network access via JDENET, thereby reducing the attack surface. Implementing strict input validation and monitoring for anomalous patterns in JDENET traffic can also help detect potential exploitation attempts before they result in service disruption. Regular security audits and adherence to Oracle's recommended configuration baselines will further strengthen resilience against such availability-focused attacks.