JD Edwards EnterpriseOne Tools vulnerabilities

65 known vulnerabilities in JD Edwards EnterpriseOne Tools from Oracle. 64 are rated high or critical, and 2 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  JD Edwards EnterpriseOne Tools: Improper Access Control

  CVE-2026-61273Aug 18, 2026Oracle

  Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.4. Easily exploitable vulnerability allows low privileged attacker with network access

• 9.8 Critical severity

  JD Edwards EnterpriseOne Tools: Improper Access Control

  CVE-2026-61272Aug 18, 2026Oracle

  Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are 9.2.0.0-9.2.26.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via H

• 8.1 High severity

  JD Edwards EnterpriseOne Tools: Improper Access Control

  CVE-2026-61268Aug 18, 2026Oracle

  Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Business Logic Infra SEC). Supported versions that are affected are 9.2.0.0-9.2.26.4. Easily exploitable vulnerability allows low privileged attacker with network acce

• 9.9 Critical severity

  JD Edwards EnterpriseOne Tools: Missing Authentication for Critical Functionality

  CVE-2026-60627Jul 21, 2026Oracle

  Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). The supported version that is affected is 9.2.26.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTT

• 8.1 High severity

  JD Edwards EnterpriseOne Tools: Missing Authentication for Critical Functionality

  CVE-2026-60621Jul 21, 2026Oracle

  Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime Security). The supported version that is affected is 9.2.26.3. Difficult to exploit vulnerability allows unauthenticated attacker with network access via H

• 9.3 Critical severity

  JD Edwards EnterpriseOne Tools: Improper Access Control

  CVE-2026-46913Jun 17, 2026Oracle

  Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.2. Easily exploitable vulnerability allows unauthenticated attacker with logon to the i

• 9.3 Critical severity

  JD Edwards EnterpriseOne Tools: Exposure of Sensitive Information to an Unauthorized Actor

  CVE-2026-46912Jun 17, 2026Oracle

  Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime Security). Supported versions that are affected are 9.2.0.0-9.2.26.2. Easily exploitable vulnerability allows unauthenticated attacker with network access

• 9.1 Critical severity

  Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component…

  CVE-2026-46910Jun 17, 2026Oracle

  Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure Security). Supported versions that are affected are 9.2.0.0-9.2.26.2. Easily exploitable vulnerability allows unauthenticated attacker with n

• 9.8 Critical severity

  JD Edwards EnterpriseOne Tools: Improper Access Control

  CVE-2026-46909Jun 17, 2026Oracle

  Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure Security). Supported versions that are affected are 9.2.0.0-9.2.26.2. Easily exploitable vulnerability allows unauthenticated attacker with n

• 9.6 Critical severity

  JD Edwards EnterpriseOne Tools: Improper Access Control

  CVE-2026-46906Jun 17, 2026Oracle

  Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure Security). Supported versions that are affected are 9.2.0.0-9.2.26.2. Easily exploitable vulnerability allows low privileged attacker with ne

• 9.8 Critical severity

  JD Edwards EnterpriseOne Tools: Missing Authentication for Critical Functionality

  CVE-2026-46905Jun 17, 2026Oracle

  Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime Security). Supported versions that are affected are 9.2.0.0-9.2.26.2. Easily exploitable vulnerability allows unauthenticated attacker with network access

• 9.8 Critical severity

  JD Edwards EnterpriseOne Tools: Improper Access Control

  CVE-2026-46904Jun 17, 2026Oracle

  Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure Security). Supported versions that are affected are 9.2.0.0-9.2.26.2. Easily exploitable vulnerability allows unauthenticated attacker with n

• 8.8 High severity

  JD Edwards EnterpriseOne Tools: Improper Privilege Management

  CVE-2026-46903Jun 17, 2026Oracle

  Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Business Logic Infrastructure Security). Supported versions that are affected are 9.2.0.0-9.2.26.2. Easily exploitable vulnerability allows low privileged attacker wit

• 9.8 Critical severity

  JD Edwards EnterpriseOne Tools: Improper Access Control

  CVE-2026-46883Jun 17, 2026Oracle

  Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure Security). Supported versions that are affected are 9.2.0.0-9.2.26.2. Easily exploitable vulnerability allows unauthenticated attacker with n

• 9.8 Critical severity

  JD Edwards EnterpriseOne Tools: Improper Access Control

  CVE-2026-46882Jun 17, 2026Oracle

  Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure Security). Supported versions that are affected are 9.2.0.0-9.2.26.2. Easily exploitable vulnerability allows unauthenticated attacker with n

• 9.8 Critical severity

  JD Edwards EnterpriseOne Tools: Improper Access Control

  CVE-2026-46881Jun 17, 2026Oracle

  Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure Security). Supported versions that are affected are 9.2.0.0-9.2.26.2. Easily exploitable vulnerability allows unauthenticated attacker with n

• 9.8 Critical severity

  JD Edwards EnterpriseOne Tools: Improper Access Control

  CVE-2026-46880Jun 17, 2026Oracle

  Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure Security). Supported versions that are affected are 9.2.0.0-9.2.26.2. Easily exploitable vulnerability allows unauthenticated attacker with n

• 9.8 Critical severity

  JD Edwards EnterpriseOne Tools: Missing Authentication for Critical Functionality

  CVE-2026-46879Jun 17, 2026Oracle

  Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure Security). Supported versions that are affected are 9.2.0.0-9.2.26.2. Easily exploitable vulnerability allows unauthenticated attacker with n

• 9.8 Critical severity

  JD Edwards EnterpriseOne Tools: Improper Access Control

  CVE-2026-46878Jun 17, 2026Oracle

  Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure Security). Supported versions that are affected are 9.2.0.0-9.2.26.2. Easily exploitable vulnerability allows unauthenticated attacker with n

• 9.8 Critical severity

  JD Edwards EnterpriseOne Tools: Missing Authentication for Critical Functionality

  CVE-2025-21524Jan 21, 2025Oracle

  Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC). Supported versions that are affected are Prior to 9.2.9.0. Easily exploitable vulnerability allows unauthenticated attacker with netwo

• 8.8 High severity

  JD Edwards EnterpriseOne Tools: Missing Authentication for Critical Functionality

  CVE-2025-21515Jan 21, 2025Oracle

  Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are Prior to 9.2.9.0. Easily exploitable vulnerability allows low privileged attacker with network access via HT

• 7.5 High severity

  JD Edwards EnterpriseOne Tools: Origin Validation Error

  CVE-2025-21511Jan 21, 2025Oracle

  Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are Prior to 9.2.9.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via H

• 7.5 High severity

  JD Edwards EnterpriseOne Tools: Observable Discrepancy

  CVE-2025-21510Jan 21, 2025Oracle

  Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are Prior to 9.2.9.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via H

• 9.8 Critical severity

  Apache HTTP Server Path Traversal Exploited

  CVE-2021-42013Oct 7, 2021ApacheEPSS 100%

  It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories ar

• 6.1 Medium severity

  JQuery Cross-Site Scripting (XSS) Exploited

  CVE-2020-11023Apr 29, 2020JqueryEPSS 84.9%

  In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untr